UadPlugin.dll

What this program actually does

UadPlugin.dll is the User Activity Detection (UAD) plugin in the GCIS security stack. It monitors seat behavior through multiple watchers — network connections, Sysmon events, log files, and AppSensor cross-session messages — and enforces rules about suspicious process/network activity during active sessions.

It runs inside NvContainerGcis.exe with MB endpoint UadPlugin, consumes AppSensorMessage_* protobuf types (foreground window, process events, window events), and coordinates with GciPlugin for feature control and GssmPlugin for process-event telemetry.

Build: version 1.0 2026-04-07-b253f97. DLL version 1.0.0.0.

---

Architecture / control flow

NvContainerGcis.exe
  └─ UadPlugin.dll
        ├─ GcisPluginTaskQueue / GciDeferredTaskQ (shared GCIS framework)
        ├─ GSConfigClient → ZoneConfig, SeatConfig, GcisConfigData
        ├─ Watchers (start on PluginStart after config load):
        │     ├─ NetworkWatcher — adapter/DNS/IP config changes
        │     ├─ AppSensorWatcher — AppSensorMessage from SSAU session
        │     ├─ LogFileWatcher — tail/parse security log files
        │     └─ SysmonWatcher — Sysmon process/network events
        ├─ GssmServiceAPI.Event.ProcessEvent — inbound process telemetry
        └─ GsecTasTelemetry — UEC events to TAS

Key RTTI: AppSensorMessage, AppSensorMessage_ForegroundWindow, AppSensorMessage_ProcessEvent, AppSensorMessage_WindowEvent, GssmServiceAPI.

---

External interfaces

GCIS Service API

Message	Purpose
GCISServiceAPI_GCISRequest_UadFeatureControl	Enable/disable UAD features (handled via GciPlugin proxy)
GCISServiceAPI_GCISRequest_* (shared)	Standard GCIS seat/session messages

Message Bus

• Endpoint: UadPlugin
• Receives AppSensor messages from SSAU session (configured in messagebus.conf cross-session peers)
• GSConfigClient_<pid>_... peer for GSConfigurator

AppSensor messages (protobuf)

Type	Inferred use
AppSensorMessage_ForegroundWindow	Track foreground window titles for rule matching
AppSensorMessage_ProcessEvent	Process create/terminate from user session
AppSensorMessage_WindowEvent	Window create/destroy/focus events

GssmServiceAPI process events

Consumes GssmServiceAPI.Event.ProcessEvent with fields: processPath, parentProcessPath, user, digitalSignature.

Windows APIs (from imports)

CreateToolhelp32Snapshot, GetAdaptersAddresses, CreateFileW, ReadDirectoryChangesW, CreateProcessW — process enumeration, network monitoring, log tailing.

---

Runtime timeline

Time (UTC)	Event	Source
19:04:52.817	Module UadPlugin v1.0, MB-endpoint UadPlugin	UadPluginCurrent.log
19:04:52.867	GSConfigurator fetch ZoneConfig/SeatConfig OK	UadPluginCurrent.log
19:04:52.882	Init OK; ***** Starting UadPlugin ****** queued	UadPluginCurrent.log
19:04:52.884	AIN subscription fails error 1	UadPluginCurrent.log
19:04:52.984	TAS session initiated	UadPluginCurrent.log
19:04:53.051	GcisConfigData not found → Failed to start UadPlugin	UadPluginCurrent.log
19:04:53.057	Stop: Stopping all watchers (watchers never fully armed)	UadPluginCurrent.log

First GCIS run (18:43) succeeded for sibling plugins when GcisConfigData was present; UadPlugin would have started watchers after config load in that path.

---

Failure modes

UEC / error string	Meaning
GSEC_UAD_Error_TooManyProcessesError	Process count threshold exceeded
GSEC_UAD_Error_ProcessExcessiveNetworkActivityError	Network burst/continuous connection limits
GSEC_UAD_Error_AttemptToEnterInvalidSteamPasswordDetected	Steam credential abuse
GSEC_UAD_Error_FailedRetrievingNetworkAdaptersInfo	NetworkWatcher init failure
GSEC_UAD_Error_UnableToOpenLogFile / UnableToReadLogFile	LogFileWatcher path issue
GSEC_UAD_Error_UnableToCreateDirChangeNotification	Directory watch failure
GSEC_UAD_Warning_SuspiciousAdapterChangeWasDetected	NIC/IP change during session
GSEC_UAD_Warning_DetectedDnsServerAddressAdded	DNS tampering indicator
GSEC_UAD_Error_UnknownActionForWindowRule	Malformed window rule config
Missing GcisConfigData	PluginStart abort (observed in snapshot)

---

Not verified

• Exact threshold values for network/process rules (in GcisConfigData blob).
• Which log files LogFileWatcher tails by default.
• Full window-rule schema and AppId parsing logic.
• Whether AppSensor cross-session delivery works when GCIS fails to start.

---

Evidence

• strings / RTTI on services/GCIS/plugins/UadPlugin.dll
• logs/GCIS/UadPluginCurrent.log, UadPluginOld.log
• services/GSP/plugins/messagebus.conf (AppSensor → UadPlugin cross-session)
• logs/GSP/GSConfiguratorPluginCurrent.log