Enumerates loaded Kernel drivers that import callback APIs

Get-DriversWithCallbacks.ps1

# Find loaded kernel drivers that register callbacks
# Requirements: NtObjectManager (https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/tree/master/NtObjectManager)

function Get-DriversWithCallbacks {
    [CmdletBinding()]
    Param()

    Get-NtKernelModule | ForEach-Object {
        $ModulePath = $_.FullPathName
        $FilePath = $null
        try {
            $FilePath = Get-NtFileFinalPath -FormatWin32Path $ModulePath -ErrorAction Stop
        } catch {
            Write-Warning "Could not find Win32 path for the driver $ModulePath"
        }

        if($FilePath) {
            $Module = Get-Win32ModuleImport -Path $FilePath
            $NtoskrnlFuncs = $Module `
                | Where-Object { $_.DllName -match 'ntoskrnl.exe'} `
                | Select-Object -ExpandProperty Functions
    
            $ImportRegex = 'PsSetCreateProcessNotifyRoutine|PsSetCreateThreadNotifyRoutine|PsSetLoadImageNotifyRoutine|CmRegisterCallback|ObRegisterCallbacks|ExRegisterCallback'
            $Callbacks = $NtoskrnlFuncs | Where-Object { $_.Name -match $ImportRegex }

            if($Callbacks) {
                New-Object psobject -Property @{
                    Path = $FilePath
                    Imports = ($Callbacks | select -ExpandProperty Name)
                }
            }
        }
    }
}