Process Id Mutator via BYOVD
Process ID Mutation via BYOVD, a PoC that causes Sysmon to fully attribute activity to any target process by patching kernel structures at runtime through a vulnerable driver.
Full writeup: medium.com/@s12deff/process-id-mutation-via-byovd
Windows tracks process identity across three independent sources:
- EPROCESS.UniqueProcessId: the PID field inside the kernel process object
- PspCidTable: the authoritative kernel handle table indexed by PID/4
- ETHREAD.Cid.UniqueProcess: a per thread copy of the owning process PID, read by ETW callbacks, minifilter callbacks, and Sysmon's driver
By patching both EPROCESS.UniqueProcessId and ETHREAD.Cid.UniqueProcess across all threads via a kernel read/write primitive (BYOVD), Sysmon attributes all subsequent activity: file writes, DNS queries, child process creation, process termination, to any process you choose. The telemetry resolves the wrong image path, the wrong parent, and builds a completely false process tree.
PID is restored before exit to avoid leaving an orphaned Event ID 1.