Windhawk snitches to my employer 🙂 #6
Replies: 7 comments 6 replies
-
Beta Was this translation helpful? Give feedback.
-
|
I'm not sure what exactly triggers CrowdStrike to mark Windhawk as having malicious behavior. It's not very surprising, though, as Windhawk injects code into all running processes, which is not something an average program does, and is a technique that's often misused. 7+ Taskbar Tweaker is probably not marked both because it only injects code into explorer.exe, and because it's a well known tool that's available for many years. If you can contact CrowdStrike and ask them about it, that would be great. Regarding VSCodium, it's an open source project based on Microsoft's code which Windhawk uses for the UI. It's probably being detected just because it was started by windhawk.exe which is flagged. In the next version of Windhawk, I'd like to add an option to exclude processes to inject code into, so it will be possible to configure Windhawk to only customize explorer.exe, like 7+ Taskbar Tweaker does. That might make it more compatible with security tools. |
Beta Was this translation helpful? Give feedback.
-
|
With Windhawk v1.0, it's now possible to exclude processes in Windhawk. Please try it and let me know whether it helps. |
Beta Was this translation helpful? Give feedback.
-
|
Yup, CrowdStrike Falcon monitors injections, even if they won't publish the list of hooked kernel/userland functions for obvious malware development reasons. They record that in the Whenever there's an alert, dubbed
That's a really impressive feat you achieved with this piece of software, congratulations. It's hard not to make snarky comments on Microsoft numerous different policies on window UI settings over the ages. I can't show you much, but from the CrowdStrike telemetry, you can correlate It's a good idea to have a system to decide whether to inject or not in processes, obv stay away of lsass, and maybe don't touch processes owned by S-1-5-18 or admin accounts ? I found your project when I finally found a way to correlate process ids to process names ( ahem ), and thank you for making it obvious in your documentation that you're injecting dlls, and for writing https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/ which is a gem. If you want to protect windhawk from being killed by CS, you'd have to pop a separate process for each injection you do, so that if it's killed because the CS bouncer says you're not invited to party in msteams.exe, it's just a temporary process that gets killed and not the main one. Have fun ! |
Beta Was this translation helpful? Give feedback.
-
|
I am having this issue with the portable version since admin won't install the normal version. |
Beta Was this translation helpful? Give feedback.
-
|
I am just here researching security issues with windhawk. Crazy you have to jump employer antiviru software |
Beta Was this translation helpful? Give feedback.
-
|
Same here. Really impressed with what Windhawk does, very unimpressed with how Windows 11 UI experience is. But similar experience. Corporate network security went nuts, classed it as an exploit (after it had been on the machine for months - and we'd discussed using it our team), isolated the machine on the network and requested it be rebuilt. I can understand, in theory it's a bad model to have a program with a plugin architecture, injecting third party code under the hood .. there's the potential for something bad to happen. That and with the amount of hassle, I won't be installing it again. In fact, after this I'm seriously considering what third party software I install on a work machine. Clearly preferable to keep network security happy and do things manually, draw work out and get paid rather than be efficient. |
Beta Was this translation helpful? Give feedback.




Uh oh!
There was an error while loading. Please reload this page.
-
When I install Windhawk on my Windows 11 work machine (either the global or the user-specific set up), I get a bunch of warnings from the CrowdStrike Falcon Sensor security software. It terminates the program and declares it has found malicious behavior. Then I get an email from corporate asking me what I'm up to. 😱
I've used the 7+ Taskbar Tweaker for years with no problems, but just upgraded to Win 11 and wanted to "fix" things. Any idea what could be causing this, and if there may be a reasonable fix?
Beta Was this translation helpful? Give feedback.
All reactions