30 Commits

Author SHA1 Message Date
chkp-ramanl 3f6e124a15 VMware: added check of physical display adapter 2021-05-04 12:38:47 +03:00
chkp-ramanl 4ebc25b651 Scoring: implemented scoring system for different categories of evasion techniques based on their prevalence and severity 2019-07-09 20:23:09 +03:00
chkp-ramanl b41629a0bf VEDetection: added user names to be checked as means of detection
VEDetection: added computer names to be checked as means of detection
VEDetection: added host names to be checked as means of detection
VEDetection: added specific files to be checked for their presence as means of detection
2019-01-31 16:16:06 +03:00
chkp-aliaksandrt 010106480d KVM: CPU Hypervisor and Vendor IDs check has been implemented
Generic: BigRamAlloc has been added - tries to allocate big amount of RAM
Generic: UserInputActivity has been added - evasion which utilizes `GetLastInputInfo` API function
Generic: DiskEnum Registry Key chech has been added - checks `System\CurrentControlSet\Services\Disk\Enum` reg key for value `0`=`*virtual`
Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: `C:\SELF.EXE`, `.*self\.*`, `.*sample.*`, `.*sandbox.*`, `.*virus.*`, `.*malware.*`
Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: `avgui.exe`, `avastsvc.exe`, `avastui.exe`, `procmon.exe`, `procmon64.exe`, `procexp.exe`, `procexp64.exe`, `ollydbg.exe`, `windbg.exe`, `avp.exe`, `bdagent.exe`, `bdwtxag.exe`, `dwengine.exe`
Generic: Max Processes number check has been added (disabled)
Generic: Process with a long name check has been added
Hyper-V: CPU HypervisorID check has been added
Parallels: CPU HypervisorID check has been added
QEMU: QEMU DiskEnum Registry Key has been added
Sandboxie: Injected sbiedll module check has been added
VMware: VMWare DiskEnum Registry Key check has been added
Xen: CPU VendorID check has been added
Xen: CPU HypervisorID check has been added
Xen: DiskEnum Registry Key check has been added
Some build warnings have been fixed
2019-01-02 17:45:51 +03:00
ar13l 8b60a13fde VEDetection: DNS module domain composition changed 2017-01-10 14:32:05 +03:00
ar13l e70f52d728 VEDetection: generic interface for drive model implemented 2017-01-09 18:02:15 +03:00
ariel19 2f7c27f38e VEDetection: DNS module is used now for user notification about detection technique result 2016-12-21 15:19:30 +03:00
ar13l a1e0e32ec0 Config: detection/evasion techniques description added 2016-09-29 17:11:43 +03:00
ar13l 98594dea9b VEDetection: File module is used now for user notification about detection technique result 2016-09-19 13:22:24 +03:00
ar13l a8a12105ff VEDetection: generic interface for the disks checks implemented 2016-09-01 18:15:12 +03:00
ar13l 2b1ecfbb58 Report: field Type added
Generic: dummy sleep patch bug fixed
2016-09-01 17:29:23 +03:00
ar13l 15a9201c4b VEDetection: generic interface for the hared folders checks implemented
VBOX: detection techniques added
VMware: detection techniques added
2016-09-01 15:35:30 +03:00
ar13l 1088bd53b9 VEDetection: generic interface for the windows checks implemented 2016-09-01 14:52:11 +03:00
ar13l 2bc45c73de Config: recursive field added 2016-09-01 13:33:34 +03:00
ar13l 48ce0d7feb Config: value_name now support arrays
Code: refactoring
2016-09-01 12:09:24 +03:00
ar13l 5d97a619e1 VEDetection: generic interface for cpuid vendor check implemented 2016-08-31 20:16:15 +03:00
ar13l 57c91d81bc Cuckoo: time tampering sandbox detection method implemented 2016-08-31 17:51:48 +03:00
ar13l 90a15e6999 VEDetection: Report module is used now for the report generation 2016-08-31 13:35:29 +03:00
ar13l 0f4ae91f37 Logger: colored console implemented
Main: banner added
2016-08-30 19:55:27 +03:00
ar13l 065ba141bf VBOX: implementation of detection techniques using VEDetection interface 2016-08-30 18:16:29 +03:00
ar13l d7c9b96ab0 VEDetection: generic interface for directory objects checks implemented 2016-08-30 17:00:26 +03:00
ar13l 14fc80d815 Config: enabled field added 2016-08-30 15:45:35 +03:00
ar13l 515f51ae2b VEDetection: VEDetection: generic interface for different firmware types checks implemented
VMWare: custom checks implemented (port, NDIS_WanIP)
2016-08-30 14:32:49 +03:00
ar13l 9c5b1f306c Config: support for different registry types added 2016-08-29 21:48:49 +03:00
ar13l 1ee0ab8958 VEDetection: generic interface for the adapters check implemented 2016-08-29 20:38:57 +03:00
ar13l 781dd4b5e8 Config: support for arrays added 2016-08-29 20:11:18 +03:00
ar13l 7ff1d39584 VEDetection: generic interface for the macs check implemented 2016-08-29 19:26:27 +03:00
ar13l dde47d8946 VEDetection: generic interface for the registries, files, devices, processes checks implemented
VMWare: implementation of detection techniques using VEDetection interface
Config: new fields added
2016-08-29 17:00:27 +03:00
ar13l a36ca08119 JSON: tiny json implemented
VEDetection: generic interface for reports grabbing and sandbox/virtual environments implemented
Logger: simple logger implemented
Cuckoo: implementation according to VEDetection interface
Main: generic working modes parsing implemented
2016-08-26 13:06:39 +03:00
ar13l 0e8abc9037 Cuckoo: raised exceptions detection implemented
Cuckoo: WMI escape implemented
Cuckoo: detection by agent.py implemented
Cuckoo: detection based on specific event presence implemented
Cuckoo: whitelisted process detection implemented
Cuckoo: reused pid detection implemented
Cuckoo: configuration artifacts detection implemented
Cuckoo: unbalanced stack detection implemented
Cuckoo: INFINITE delay skip detection implemented
Cuckoo: delays accumulation detection implemented
Cuckoo: functions hooking detection implemented
Cuckoo: agent.py artifacts detection implemented
2016-08-22 17:36:28 +03:00