Minifilters

Filter Manager architecture, FLT_REGISTRATION, pre- and post-operation callbacks, altitude ordering, FltSendMessage for kernel-to-user communication, and file system monitoring for detection

Filter Manager Architecture

File System I/O Path with Minifilters:

  User mode:
    CreateFile("victim.docx") → WriteFile(...) → ReadFile(...)

  Kernel I/O stack (top to bottom):
    I/O Manager generates IRP_MJ_WRITE IRP

    Filter Manager (FltMgr.sys) ─── highest-level file system driver
       |
       +─ Minifilter altitude 420000: Backup filter (pre-op → post-op)
       |
       +─ Minifilter altitude 385000: EDR scanner (pre-op → post-op)
       |    |
       |    +─ Pre-op: read buffer, hash content, block if malicious
       |    +─ Post-op: log result, send event to user-mode service
       |
       +─ Minifilter altitude 320000: AV scan-on-write (pre-op → post-op)
       |
       +─ Minifilter altitude 140000: Encryption filter (post-op)
       |
       v
    NTFS / FAT32 / exFAT file system driver (base driver)
       |
       v
    Storage stack → disk

The Filter Manager (fltmgr.sys) is a Windows-supplied infrastructure driver that manages the minifilter stack. Minifilters no longer need to manage legacy filter driver complexity (chaining, pass-through, etc.) — they register with the Filter Manager and the Filter Manager handles IRP forwarding based on altitude order.

Altitude Ranges

FLT_REGISTRATION — Minifilter Registration

// Operation callbacks array
const FLT_OPERATION_REGISTRATION Callbacks[] = {
    {
        .MajorFunction = IRP_MJ_CREATE,
        .PreOperation  = PreCreateCallback,
        .PostOperation = PostCreateCallback
    },
    {
        .MajorFunction = IRP_MJ_WRITE,
        .PreOperation  = PreWriteCallback,
        .PostOperation = NULL
    },
    {
        .MajorFunction = IRP_MJ_READ,
        .PreOperation  = PreReadCallback,
        .PostOperation = NULL
    },
    { IRP_MJ_OPERATION_END }  // must be last
};

// Registration structure passed to FltRegisterFilter
const FLT_REGISTRATION FilterRegistration = {
    .Size                   = sizeof(FLT_REGISTRATION),
    .Version                = FLT_REGISTRATION_VERSION,
    .Flags                  = 0,
    .ContextRegistration    = NULL,
    .OperationRegistration  = Callbacks,
    .FilterUnloadCallback   = FilterUnload,
    .InstanceSetupCallback  = InstanceSetup,
    .InstanceQueryTeardown  = InstanceQueryTeardown,
    .InstanceTeardownStart  = NULL,
    .InstanceTeardownComplete = NULL,
};

PFLT_FILTER g_Filter;

NTSTATUS DriverEntry(PDRIVER_OBJECT DrvObj, PUNICODE_STRING RegPath) {
    NTSTATUS status;

    // Register with Filter Manager
    status = FltRegisterFilter(DrvObj, &FilterRegistration, &g_Filter);
    if (!NT_SUCCESS(status)) return status;

    // Start filtering (begin receiving IRP callbacks)
    status = FltStartFiltering(g_Filter);
    if (!NT_SUCCESS(status)) {
        FltUnregisterFilter(g_Filter);
        return status;
    }
    return STATUS_SUCCESS;
}

Pre and Post Operation Callbacks

Pre-operation callbacks can inspect or modify the I/O before it proceeds. They return one of three key values:

FLT_PREOP_CALLBACK_STATUS PreWriteCallback(
    PFLT_CALLBACK_DATA    Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID                 *CompletionContext)
{
    // Get process context: who is writing?
    PEPROCESS proc = IoThreadToProcess(Data->Thread);
    HANDLE pid  = PsGetProcessId(proc);

    // Get write buffer
    PVOID writeBuffer = NULL;
    ULONG writeLength = Data->Iopb->Parameters.Write.Length;

    if (Data->Iopb->Parameters.Write.MdlAddress) {
        writeBuffer = MmGetSystemAddressForMdlSafe(
            Data->Iopb->Parameters.Write.MdlAddress,
            NormalPagePriority);
    } else {
        writeBuffer = Data->Iopb->Parameters.Write.WriteBuffer;
    }

    // Simple entropy check for ransomware detection
    if (writeBuffer && writeLength > 4096) {
        double entropy = ComputeEntropy(writeBuffer, writeLength);
        if (entropy > 7.8) {
            // High entropy write — suspicious (possible encryption)
            SendAlertToUserMode(FltObjects->FileObject, pid, entropy);
            // Optional block: uncomment to deny the write
            // Data->IoStatus.Status = STATUS_ACCESS_DENIED;
            // Data->IoStatus.Information = 0;
            // return FLT_PREOP_COMPLETE;
        }
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

Kernel-to-User-Mode Communication via FltSendMessage

Minifilters communicate with their user-mode companion service through Filter Manager communication ports. The kernel side creates a server port; the user-mode service connects as a client. The kernel driver sends events; the user-mode component can send commands back:

// Kernel side: create communication port
PFLT_PORT g_ServerPort;
PFLT_PORT g_ClientPort;

NTSTATUS ConnectNotify(PFLT_PORT ClientPort, PVOID ServerPortCookie,
                         PVOID ConnectionContext, ULONG SizeOfContext,
                         PVOID *ConnectionPortCookie) {
    g_ClientPort = ClientPort;
    return STATUS_SUCCESS;
}

// Create the server port during DriverEntry:
UNICODE_STRING portName = RTL_CONSTANT_STRING(L"\ScannerPort");
OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &portName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
                            NULL, NULL);
FltCreateCommunicationPort(g_Filter, &g_ServerPort, &oa,
    NULL, ConnectNotify, DisconnectNotify, MessageNotify, 1);

// Send event to user mode from pre-write callback:
typedef struct _SCAN_EVENT {
    HANDLE  Pid;
    ULONG   WriteLength;
    double  Entropy;
    WCHAR   FileName[256];
} SCAN_EVENT;

VOID SendAlertToUserMode(PFILE_OBJECT FileObj, HANDLE Pid, double Entropy) {
    if (!g_ClientPort) return;

    SCAN_EVENT evt = { .Pid = Pid, .Entropy = Entropy };
    ULONG replyLen = 0;

    FltSendMessage(g_Filter, &g_ClientPort, &evt, sizeof(evt),
                   NULL, &replyLen, NULL);
}

Minifilter Bypass Techniques

Q & A