Remote IP Address in MiniFilter

NTFSD
1

Is there any known method of retrieving the caller’s IP address inside a filter driver? I’ve got a minifilter driver running on a server and am auditing file activity from users across the network. Obviously I cannot determine the remote process name or process ID that is opening the file, but I would like to get the IP address of the remote computer opening the file.

Is this possible with the information given, such as the FILE_OBJECT?

2

We can get SID from IO_SECURITY_CONTEXT structure while a file is being created(from IrpSp->Parameters.Create.SecurityContext). Following functions may be helpfull-

SeQuerySubjectContextToken
SeQueryInformationToken

SeQueryInformationToken accepts TOKEN_SOURCE pointer as its third parameter. It has a member [SourceName]. I think it should help.

Please let me know if you need more details.