TrojPix: Mitigating RF Data Exfiltration from Air-Gapped Systems

---
title: TrojPix - Process Injection into Desktop Window Manager
id: 89c3b123-45d6-7e8f-90a1-b2345678c9d0
status: experimental
description: Detects potential process injection into dwm.exe, often required to hook display calls for optical channel exfiltration like TrojPix.
references:
  - https://thehackernews.com/2026/07/new-trojpix-attack-leaks-data-from-air.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.defense_evasion
  - attack.t1055.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    TargetImage|endswith: '\dwm.exe'
    GrantedAccess|contains:
 - 'PROCESS_VM_WRITE'
      - 'PROCESS_CREATE_THREAD'
falsepositives:
  - Legitimate system utilities interacting with window manager
level: high
---
title: TrojPix - Suspicious Graphics Driver Interaction
id: 1a2b3c4d-5e6f-7890-1234-56789abcdef0
status: experimental
description: Detects non-system processes loading critical graphics DLLs (gdi32.dll, dxgi.dll) which may indicate hooking for pixel manipulation.
references:
  - https://thehackernews.com/2026/07/new-trojpix-attack-leaks-data-from-air.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1113
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
      - '\gdi32.dll'
      - '\dxgi.dll'
      - '\opengl32.dll'
  filter:
    Image|contains:
      - '\System32\'
      - '\SysWOW64\'
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter
falsepositives:
  - Legacy applications or custom imaging software
level: medium
---
title: TrojPix - CLI Screen Capture Utilities
id: f1e2d3c4-b5a6-7890-cdef-1234567890ab
status: experimental
description: Detects command-line usage of common screen capture or manipulation tools often used in staging for exfiltration.
references:
  - https://thehackernews.com/2026/07/new-trojpix-attack-leaks-data-from-air.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1113
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'screenshot'
      - 'capture-screen'
      - 'pixelseek'
      - 'ImageMagick'
falsepositives:
  - Authorized administrative troubleshooting
level: low

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ActionType == "ProcessInjection" or ActionType == "RemoteThreadCreated"
| where TargetProcessFileName =~ "dwm.exe" or TargetProcessFileName =~ "explorer.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, TargetProcessFileName
| order by Timestamp desc

-- Hunt for processes accessing display/video devices
SELECT Pid, Name, Exe, CommandLine, 
       foreach(split(string=Handles.Handles.Name, sep=","), x={ 
           if(condition=~ x =~ "Video" or x =~ "Display", then=x, else="")
       }) as VideoHandles
FROM pslist()
WHERE VideoHandles

<#
.SYNOPSIS
    Audit graphics drivers for integrity as part of TrojPix defense.
.DESCRIPTION
    Checks the digital signature of display drivers and ensures 
    no unauthorized unsigned drivers are loaded in the graphics stack.
#>

Write-Host "[+] Initiating Graphics Driver Integrity Check..." -ForegroundColor Cyan

# Get display drivers via WMI
$displayDrivers = Get-WmiObject Win32_VideoController

foreach ($driver in $displayDrivers) {
    $driverPath = $driver.InstalledDisplayDrivers
    Write-Host "[+] Checking Driver: $($driver.Name)" -ForegroundColor Yellow
    
    if ($driverPath -and (Test-Path $driverPath)) {
        $sig = Get-AuthenticodeSignature -FilePath $driverPath
        
        if ($sig.Status -ne 'Valid') {
            Write-Host "[!] ALERT: Unsigned or Invalid Signature Detected at $driverPath" -ForegroundColor Red
            # In a real IR scenario, trigger an alert here
        } else {
            Write-Host "[OK] Signature Valid: $($sig.SignerCertificate.Subject)" -ForegroundColor Green
        }
    }
}

# Check for unsigned DLLs loaded into dwm.exe (Desktop Window Manager)
Write-Host "[+] Scanning unsigned DLLs in dwm.exe process space..." -ForegroundColor Cyan

$dwmProcess = Get-Process dwm -ErrorAction SilentlyContinue
if ($dwmProcess) {
    $modules = $dwmProcess.Modules
    foreach ($mod in $modules) {
        $sig = Get-AuthenticodeSignature -FilePath $mod.FileName -ErrorAction SilentlyContinue
        if ($sig.Status -eq 'NotSigned' -and $mod.FileName -notlike "*C:\Windows\System32*" -and $mod.FileName -notlike "*C:\Windows\WinSxS*") {
            Write-Host "[!] Suspicious Unsigned DLL in dwm.exe: $($mod.FileName)" -ForegroundColor Red
        }
    }
} else {
    Write-Host "[-] dwm.exe not running." -ForegroundColor Gray
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan


**Remediation**

1.  **Zero Trust Physical Security:** Since TrojPix requires a receiver near the cable, enforce strict "No Personal Devices" policies in secure zones. Ensure air-gapped systems are located in RF-shielded rooms (Faraday cages) or where physical access to the cabling is impossible.
2.  **Software Allowlisting:** The primary vector for TrojPix is the initial malware. Ensure strict application allowlisting (e.g., AppLocker, Windows Defender Application Control) is active on all air-gapped endpoints to prevent the execution of the malware required to drive the pixel modulation.
3.  **Driver Integrity Monitoring:** Regularly audit the signature integrity of graphics drivers (`gdi32.dll`, `dxgi.dll`, vendor-specific driver files). Tampering with these drivers is a necessary step for advanced pixel manipulation.
4.  **Cable Hygiene:** Where possible, use high-quality, heavily shielded fiber optic cabling (HDMI Fiber) which does not emit electromagnetic radiation in the same way as copper cables. If using copper, ensure ferrite chokes are installed and undamaged.
5.  **Endpoint Detection:** Deploy the Sigma rules provided above to detect process injection into `dwm.exe` or suspicious loading of graphics libraries by unauthorized processes.