Prochainement documenté :

mimikatz # [...]
kListNotifyObjects

[...]
Process
 - Open        : FFFFF80002DA6960 [ntoskrnl.exe+3463520]
 - Close       : FFFFF80002D8B074 [ntoskrnl.exe+3350644]
 - Delete      : FFFFF80002D8A330 [ntoskrnl.exe+3347248]
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF880033083C8 [klif.sys+218056] / FFFFF880033087D4 [klif.sys+219092]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

Token
 - Delete      : FFFFF80002D9BED0 [ntoskrnl.exe+3419856]
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

Mutant
 - Delete      : FFFFF80002AA27E4 [ntoskrnl.exe+301028]
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

File
 - Close       : FFFFF80002DDB580 [ntoskrnl.exe+3679616]
 - Delete      : FFFFF80002DCFEC0 [ntoskrnl.exe+3632832]
 - Parse       : FFFFF80002DF7AF0 [ntoskrnl.exe+3795696]
 - Security    : FFFFF80002DB3240 [ntoskrnl.exe+3514944]
 - QueryName   : FFFFF80002DB3514 [ntoskrnl.exe+3515668]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

Semaphore
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

Section
 - Delete      : FFFFF80002DEFFA0 [ntoskrnl.exe+3764128]
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

Thread
 - Open        : FFFFF80002DBF91C [ntoskrnl.exe+3565852]
 - Delete      : FFFFF80002DA9030 [ntoskrnl.exe+3473456]
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF880033083C8 [klif.sys+218056] / FFFFF880033087D4 [klif.sys+219092]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

Event
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

ALPC Port
 - Open        : FFFFF80002DB1980 [ntoskrnl.exe+3508608]
 - Close       : FFFFF80002D76EA0 [ntoskrnl.exe+3268256]
 - Delete      : FFFFF80002D759D4 [ntoskrnl.exe+3262932]
 - Security    : FFFFF80002DBDCA0 [ntoskrnl.exe+3558560]
 * Callback 1  : FFFFF88004212240 [SbieDrv.sys+74304] / FFFFF8800421742C [SbieDrv.sys+95276]

L’activation de callbacks sur d’autre objets que les Process et Threads par Sandboxie en x64 est non supporté, mais cela reste quand même plus propre qu’en x86 où il remplace les procédures système par défaut de ces objets…

mimikatz # [...]
kListNotifyObjects

[...]
Process
 - Open        : 9269B070 [?]
 - Close       : 82ABFF55 [ntkrnlpa.exe+2559829]
 - Delete      : 82AC281C [ntkrnlpa.exe+2570268]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]
 * Callback 3  : 87CCACB2 [MpFilter.sys+97458] / 00000000 [?]

Token
 - Open        : 9269B020 [?]
 - Delete      : 82AA9120 [ntkrnlpa.exe+2466080]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

Mutant
 - Open        : 9269B250 [?]
 - Delete      : 8290FFAB [ntkrnlpa.exe+790443]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

File
 - Close       : 82A8188B [ntkrnlpa.exe+2304139]
 - Delete      : 82A809D3 [ntkrnlpa.exe+2300371]
 - Parse       : 9269B110 [?]
 - Security    : 82AB33BD [ntkrnlpa.exe+2507709]
 - QueryName   : 82ABF86E [ntkrnlpa.exe+2558062]

Semaphore
 - Open        : 9269B2A0 [?]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

Section
 - Open        : 9269B2F0 [?]
 - Delete      : 82A71981 [ntkrnlpa.exe+2238849]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

Thread
 - Open        : 9269B0C0 [?]
 - Delete      : 82AB89BB [ntkrnlpa.exe+2529723]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

Event
 - Open        : 9269B200 [?]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

ALPC Port
 - Open        : 9269B340 [?]
 - Close       : 82AAF0A3 [ntkrnlpa.exe+2490531]
 - Delete      : 82AAE8AC [ntkrnlpa.exe+2488492]
 - Security    : 82AB47D6 [ntkrnlpa.exe+2512854]

Device
 - Delete      : 82A0A338 [ntkrnlpa.exe+1815352]
 - Parse       : 9269B160 [?]
 - Security    : 82AB33BD [ntkrnlpa.exe+2507709]

Key
 - Close       : 82A9B2E6 [ntkrnlpa.exe+2409190]
 - Delete      : 82A8280B [ntkrnlpa.exe+2308107]
 - Parse       : 9269B1B0 [?]
 - Security    : 82A4431B [ntkrnlpa.exe+2052891]
 - QueryName   : 82A3AD00 [ntkrnlpa.exe+2014464]

Malgré le ? indiquant l’abscence de référence pour l’adresse 0x9269b070 en ligne 6, il s’agit bien de Sandboxie qui a placé un trampoline :

9269b070 8bc0            mov     eax,eax
9269b072 b88e07b191      mov     eax,offset SbieDrv+0x1378e (91b1078e)
9269b077 6a00            push    0
9269b079 6a00            push    0
9269b07b ffd0            call    eax