90 Commits

Author SHA1 Message Date
Alexander Chailytko c515e8929a Merge pull request #15 from chkp-alexeybu/ab_default_configs
Added flexible build configurations to enable running without command line. Fixed issues #12 and #14.
2022-04-05 14:05:23 +03:00
chkp-alexeybu f6a9ebceef Added flexible build configurations to enable running without command line
Removed configuration file for the HTML report template
Scripts migrated to Python 3
2022-04-05 11:59:40 +03:00
Alexander Chailytko 9e0d2e6b1f Merge pull request #13 from CheckPointSW/integrate-sourceguard
Integrate SourceGuard Code Analysis
2022-03-25 14:41:25 +03:00
Ron Izraeli 6826eb33d8 Integrate SourceGuard Code Analysis 2022-03-15 14:21:17 +02:00
chkp-alexeybu d6fa72cb4d Cuckoo: check for invalid hook of NtLoadKeyEx added
Cuckoo: lack of argument checks in NtDelayExecution evasion added
2022-02-07 14:22:33 +03:00
chkp-ramanl 17f2a5a483 Fixed indents in configuration files 2021-05-04 12:39:36 +03:00
chkp-ramanl 3f6e124a15 VMware: added check of physical display adapter 2021-05-04 12:38:47 +03:00
Alexander Chailytko 38a153824f Merge pull request #9 from chkp-yaroslavh/master
Added a check if an audio device is attached to the PC
2019-12-18 17:33:38 +03:00
chkp-yaroslavh 3f4295bb1b Generic: AudioDeviceAbsence has been added - checks if an audio device is attached to the PC 2019-11-14 16:06:28 +03:00
chkp-ramanl 4ebc25b651 Scoring: implemented scoring system for different categories of evasion techniques based on their prevalence and severity 2019-07-09 20:23:09 +03:00
chkp-ramanl b41629a0bf VEDetection: added user names to be checked as means of detection
VEDetection: added computer names to be checked as means of detection
VEDetection: added host names to be checked as means of detection
VEDetection: added specific files to be checked for their presence as means of detection
2019-01-31 16:16:06 +03:00
Alexander Chailytko 2602c5fae5 Merge pull request #7 from chkp-aliaksandrt/improvements-dec2018
New evasions and general improvements
2019-01-02 17:58:10 +03:00
chkp-aliaksandrt 010106480d KVM: CPU Hypervisor and Vendor IDs check has been implemented
Generic: BigRamAlloc has been added - tries to allocate big amount of RAM
Generic: UserInputActivity has been added - evasion which utilizes `GetLastInputInfo` API function
Generic: DiskEnum Registry Key chech has been added - checks `System\CurrentControlSet\Services\Disk\Enum` reg key for value `0`=`*virtual`
Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: `C:\SELF.EXE`, `.*self\.*`, `.*sample.*`, `.*sandbox.*`, `.*virus.*`, `.*malware.*`
Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: `avgui.exe`, `avastsvc.exe`, `avastui.exe`, `procmon.exe`, `procmon64.exe`, `procexp.exe`, `procexp64.exe`, `ollydbg.exe`, `windbg.exe`, `avp.exe`, `bdagent.exe`, `bdwtxag.exe`, `dwengine.exe`
Generic: Max Processes number check has been added (disabled)
Generic: Process with a long name check has been added
Hyper-V: CPU HypervisorID check has been added
Parallels: CPU HypervisorID check has been added
QEMU: QEMU DiskEnum Registry Key has been added
Sandboxie: Injected sbiedll module check has been added
VMware: VMWare DiskEnum Registry Key check has been added
Xen: CPU VendorID check has been added
Xen: CPU HypervisorID check has been added
Xen: DiskEnum Registry Key check has been added
Some build warnings have been fixed
2019-01-02 17:45:51 +03:00
Alexander Chailytko 1f5d6f16c3 Added link to video recording from ShmooCon 2017 2018-10-03 12:28:43 +03:00
Alexey Bukhteyev 02ea69cff4 Cuckoo: ResultserverConnection detection technique implemented 2018-04-10 11:02:48 +03:00
Alexey Bukhteyev 3e4e5a36f6 Vbox: added virtual devices to be checked as means of detection
Vbox: added MAC address to be checked as means of detection
VMware: added file names to be checked as means of detection
VMware: added registry paths and values to be checked as means of detection
VMware: added running processes to be checked as means of detection
BOCHS: implementation of detection techniques using VEDetection interface
Hyper-V: implementation of detection techniques using VEDetection interface
JoeBox: implementation of detection techniques using VEDetection interface
Parallels: implementation of detection techniques using VEDetection interface
QEMU: implementation of detection techniques using VEDetection interface
Sandboxie: implementation of detection techniques using VEDetection interface
VirtualPC: implementation of detection techniques using VEDetection interface
Wine: implementation of detection techniques using VEDetection interface
Xen: implementation of detection techniques using VEDetection interface
Miscellaneous sandboxes: implementation of detection techniques using VEDetection interface
Added config for BOCHS evasions: checking registry
Added config for Hyper-V evasions: checking registry, global objects in OS
Added config for JoeBox evasions: checking registry, running processes
Added config for Parallels evasions: checking filesystem, registry, firmware tables, running processes, global objects in OS
Added config for QEMU evasions: checking registry, disk name
Added config for Sandboxie evasions: checking registry, global objects in OS
Added config for VirtualPC evasions: checking registry, firmware tables, disk name, running processes, global devices in OS
Added config for Wine evasions: checking registry
Added config for Xen evasions: checking registry, running processes
Added config for miscellaneous VM and sandboxes evasions
Generic: fixed bug in raw mouse activity check
gitignore: updated
2018-04-09 17:45:02 +03:00
Stanislav Skuratovich 46ca97a51d Generic: raw mouse activity check implemented 2017-08-04 17:27:04 +03:00
Stanislav Skuratovich 54516d034b Generic: DNS response check servers changed
Generic: PerformanceCounter detection technique implemented
2017-08-03 18:28:50 +03:00
Stanislav Skuratovich d67a70942d Cuckoo: SocketTimeout detection technique implemented
VEDetection: generic interface for drive model vendor added
2017-08-03 15:04:53 +03:00
Stanislav Skuratovich 4732ecd14e OpenProcess condition bug fix 2017-03-03 12:57:26 +03:00
ar13l 01552597f4 Cuckoo: TickCount integrity check cast bug fixed 2017-01-24 14:24:29 +03:00
ar13l 82597eb731 Cuckoo: TickCount integrity check implemented 2017-01-19 16:20:24 +03:00
ar13l b3170a3d71 Cuckoo: DelayInterval detection technique implemented 2017-01-19 11:51:07 +03:00
MalwareResearch dcec8b7d1a Adding ShmooCon 2017 to presentations list 2017-01-18 15:08:23 +03:00
ar13l 774b5cc6dd New slides added 2017-01-18 14:56:55 +03:00
MalwareResearch da906a1e90 Adjusted repository name, links and credits 2017-01-11 16:29:28 +03:00
ar13l 8b60a13fde VEDetection: DNS module domain composition changed 2017-01-10 14:32:05 +03:00
ar13l 5231ee6e96 VMWare: i/o ports detection implemented 2017-01-10 13:31:42 +03:00
ar13l e70f52d728 VEDetection: generic interface for drive model implemented 2017-01-09 18:02:15 +03:00
ar13l 3defb69b57 Cuckoo: SuspendedThread evasion technique implemented 2017-01-09 13:17:28 +03:00
ar13l 5372b543d2 Cuckoo: Dead Analyzer evasion technique implemented 2017-01-06 19:56:22 +03:00
ar13l 43dd12b54a Cuckoo: differentiation between real and sandbox machines implemented while performing evasions (function hooks are used). If hooks are fixed. then another method should be used. 2017-01-06 17:39:08 +03:00
MalwareResearch 50ba964057 Update README.md 2017-01-04 17:21:20 +03:00
MalwareResearch d3d6a9cc91 Logo file added 2017-01-04 15:58:46 +03:00
ar13l 8a1b52c640 Uninitialized dns_interface variable bug fixed 2016-12-22 16:01:12 +03:00
ar13l 78c0eb8a27 Detect by Wireshark device moved to Generic 2016-12-22 12:00:26 +03:00
ariel19 2f7c27f38e VEDetection: DNS module is used now for user notification about detection technique result 2016-12-21 15:19:30 +03:00
MalwareResearch 381d2ea96d Update README.md 2016-10-13 15:40:01 +03:00
MalwareResearch e2f809661f Slides from Virus Bulletin 2016 conference link added 2016-10-10 14:37:05 +03:00
ar13l f7f9b2e452 VB2016 slides added 2016-10-10 14:27:49 +03:00
MalwareResearch 96b973326f Update README.md 2016-10-06 09:21:31 -06:00
MalwareResearch bcbce3f150 Update README.md 2016-10-05 23:44:09 +03:00
MalwareResearch 21627d2401 Update README.md 2016-10-05 23:29:22 +03:00
ar13l 45ff60b4f3 Original parameters for debugging purpose restored 2016-10-03 13:36:18 +03:00
ar13l 215fbe6ad9 Cuckoo: moving date/time tampering technique to Generic 2016-10-03 13:29:45 +03:00
ar13l b38f519dcf DEBUG configuration removed 2016-09-29 18:15:52 +03:00
ar13l 39e2ff7b54 Fixing bug that occurs while compiling in DEBUG mode 2016-09-29 17:59:51 +03:00
ar13l a1e0e32ec0 Config: detection/evasion techniques description added 2016-09-29 17:11:43 +03:00
ar13l 90c6913187 Cuckoo: delays accumulation detection technique reimplemented 2016-09-28 17:59:02 +03:00
ar13l 5bfa26a4b9 Cuckoo: detection by configuration file technique reimplemented 2016-09-28 15:26:51 +03:00