f6a9ebceef
Added flexible build configurations to enable running without command line
...
Removed configuration file for the HTML report template
Scripts migrated to Python 3
2022-04-05 11:59:40 +03:00
3f6e124a15
VMware: added check of physical display adapter
2021-05-04 12:38:47 +03:00
3f4295bb1b
Generic: AudioDeviceAbsence has been added - checks if an audio device is attached to the PC
2019-11-14 16:06:28 +03:00
b41629a0bf
VEDetection: added user names to be checked as means of detection
...
VEDetection: added computer names to be checked as means of detection
VEDetection: added host names to be checked as means of detection
VEDetection: added specific files to be checked for their presence as means of detection
2019-01-31 16:16:06 +03:00
010106480d
KVM: CPU Hypervisor and Vendor IDs check has been implemented
...
Generic: BigRamAlloc has been added - tries to allocate big amount of RAM
Generic: UserInputActivity has been added - evasion which utilizes `GetLastInputInfo` API function
Generic: DiskEnum Registry Key chech has been added - checks `System\CurrentControlSet\Services\Disk\Enum` reg key for value `0`=`*virtual`
Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: `C:\SELF.EXE`, `.*self\.*`, `.*sample.*`, `.*sandbox.*`, `.*virus.*`, `.*malware.*`
Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: `avgui.exe`, `avastsvc.exe`, `avastui.exe`, `procmon.exe`, `procmon64.exe`, `procexp.exe`, `procexp64.exe`, `ollydbg.exe`, `windbg.exe`, `avp.exe`, `bdagent.exe`, `bdwtxag.exe`, `dwengine.exe`
Generic: Max Processes number check has been added (disabled)
Generic: Process with a long name check has been added
Hyper-V: CPU HypervisorID check has been added
Parallels: CPU HypervisorID check has been added
QEMU: QEMU DiskEnum Registry Key has been added
Sandboxie: Injected sbiedll module check has been added
VMware: VMWare DiskEnum Registry Key check has been added
Xen: CPU VendorID check has been added
Xen: CPU HypervisorID check has been added
Xen: DiskEnum Registry Key check has been added
Some build warnings have been fixed
2019-01-02 17:45:51 +03:00
02ea69cff4
Cuckoo: ResultserverConnection detection technique implemented
2018-04-10 11:02:48 +03:00
d67a70942d
Cuckoo: SocketTimeout detection technique implemented
...
VEDetection: generic interface for drive model vendor added
2017-08-03 15:04:53 +03:00
8b60a13fde
VEDetection: DNS module domain composition changed
2017-01-10 14:32:05 +03:00
e70f52d728
VEDetection: generic interface for drive model implemented
2017-01-09 18:02:15 +03:00
3defb69b57
Cuckoo: SuspendedThread evasion technique implemented
2017-01-09 13:17:28 +03:00
5372b543d2
Cuckoo: Dead Analyzer evasion technique implemented
2017-01-06 19:56:22 +03:00
43dd12b54a
Cuckoo: differentiation between real and sandbox machines implemented while performing evasions (function hooks are used). If hooks are fixed. then another method should be used.
2017-01-06 17:39:08 +03:00
2f7c27f38e
VEDetection: DNS module is used now for user notification about detection technique result
2016-12-21 15:19:30 +03:00
39e2ff7b54
Fixing bug that occurs while compiling in DEBUG mode
2016-09-29 17:59:51 +03:00
4a9c5218a0
VEDetection: File module is now writes bytes to detection file in order to be visible in behavioral analysis
2016-09-20 15:11:01 +03:00
98594dea9b
VEDetection: File module is used now for user notification about detection technique result
2016-09-19 13:22:24 +03:00
c871f84df5
Cuckoo: EXCEPTION_MAXCOUNT adopted
2016-09-02 11:10:25 +03:00
a8a12105ff
VEDetection: generic interface for the disks checks implemented
2016-09-01 18:15:12 +03:00
15a9201c4b
VEDetection: generic interface for the hared folders checks implemented
...
VBOX: detection techniques added
VMware: detection techniques added
2016-09-01 15:35:30 +03:00
2bc45c73de
Config: recursive field added
2016-09-01 13:33:34 +03:00
5d97a619e1
VEDetection: generic interface for cpuid vendor check implemented
2016-08-31 20:16:15 +03:00
7058e497f3
Generic: DNS response check implemented
2016-08-31 18:59:37 +03:00
57c91d81bc
Cuckoo: time tampering sandbox detection method implemented
2016-08-31 17:51:48 +03:00
99ec56f37b
Generic: implementation of detection techniques using VEDetection interface
2016-08-31 16:46:01 +03:00
0b06377a0e
Report: dummy module that is responsible for HTML report generation implemented
2016-08-31 12:47:41 +03:00
0f4ae91f37
Logger: colored console implemented
...
Main: banner added
2016-08-30 19:55:27 +03:00
d7c9b96ab0
VEDetection: generic interface for directory objects checks implemented
2016-08-30 17:00:26 +03:00
515f51ae2b
VEDetection: VEDetection: generic interface for different firmware types checks implemented
...
VMWare: custom checks implemented (port, NDIS_WanIP)
2016-08-30 14:32:49 +03:00
9c5b1f306c
Config: support for different registry types added
2016-08-29 21:48:49 +03:00
1ee0ab8958
VEDetection: generic interface for the adapters check implemented
2016-08-29 20:38:57 +03:00
434b4cf75e
Helper: fixing bug when 32-bit process on 32-bit OS fails due to unavailable fs redirection
2016-08-29 20:22:13 +03:00
7ff1d39584
VEDetection: generic interface for the macs check implemented
2016-08-29 19:26:27 +03:00
dde47d8946
VEDetection: generic interface for the registries, files, devices, processes checks implemented
...
VMWare: implementation of detection techniques using VEDetection interface
Config: new fields added
2016-08-29 17:00:27 +03:00
a36ca08119
JSON: tiny json implemented
...
VEDetection: generic interface for reports grabbing and sandbox/virtual environments implemented
Logger: simple logger implemented
Cuckoo: implementation according to VEDetection interface
Main: generic working modes parsing implemented
2016-08-26 13:06:39 +03:00
9260563277
Cuckoo: WMI OpenProcess flag changed to PROCESS_QUERY_INFORMATION
2016-08-24 14:45:58 +03:00
73c1db7360
Cuckoo: Task Scheduler escape implemented (Windows Vista and upper)
2016-08-24 12:06:52 +03:00
0e8abc9037
Cuckoo: raised exceptions detection implemented
...
Cuckoo: WMI escape implemented
Cuckoo: detection by agent.py implemented
Cuckoo: detection based on specific event presence implemented
Cuckoo: whitelisted process detection implemented
Cuckoo: reused pid detection implemented
Cuckoo: configuration artifacts detection implemented
Cuckoo: unbalanced stack detection implemented
Cuckoo: INFINITE delay skip detection implemented
Cuckoo: delays accumulation detection implemented
Cuckoo: functions hooking detection implemented
Cuckoo: agent.py artifacts detection implemented
2016-08-22 17:36:28 +03:00
chkp-alexeybu