Commit Graph

8 Commits

Author SHA1 Message Date
Alexey Bukhteyev 3e4e5a36f6 Vbox: added virtual devices to be checked as means of detection
Vbox: added MAC address to be checked as means of detection
VMware: added file names to be checked as means of detection
VMware: added registry paths and values to be checked as means of detection
VMware: added running processes to be checked as means of detection
BOCHS: implementation of detection techniques using VEDetection interface
Hyper-V: implementation of detection techniques using VEDetection interface
JoeBox: implementation of detection techniques using VEDetection interface
Parallels: implementation of detection techniques using VEDetection interface
QEMU: implementation of detection techniques using VEDetection interface
Sandboxie: implementation of detection techniques using VEDetection interface
VirtualPC: implementation of detection techniques using VEDetection interface
Wine: implementation of detection techniques using VEDetection interface
Xen: implementation of detection techniques using VEDetection interface
Miscellaneous sandboxes: implementation of detection techniques using VEDetection interface
Added config for BOCHS evasions: checking registry
Added config for Hyper-V evasions: checking registry, global objects in OS
Added config for JoeBox evasions: checking registry, running processes
Added config for Parallels evasions: checking filesystem, registry, firmware tables, running processes, global objects in OS
Added config for QEMU evasions: checking registry, disk name
Added config for Sandboxie evasions: checking registry, global objects in OS
Added config for VirtualPC evasions: checking registry, firmware tables, disk name, running processes, global devices in OS
Added config for Wine evasions: checking registry
Added config for Xen evasions: checking registry, running processes
Added config for miscellaneous VM and sandboxes evasions
Generic: fixed bug in raw mouse activity check
gitignore: updated
2018-04-09 17:45:02 +03:00
Stanislav Skuratovich 46ca97a51d Generic: raw mouse activity check implemented 2017-08-04 17:27:04 +03:00
Stanislav Skuratovich 54516d034b Generic: DNS response check servers changed
Generic: PerformanceCounter detection technique implemented
2017-08-03 18:28:50 +03:00
ar13l 78c0eb8a27 Detect by Wireshark device moved to Generic 2016-12-22 12:00:26 +03:00
ar13l 215fbe6ad9 Cuckoo: moving date/time tampering technique to Generic 2016-10-03 13:29:45 +03:00
ar13l 2b1ecfbb58 Report: field Type added
Generic: dummy sleep patch bug fixed
2016-09-01 17:29:23 +03:00
ar13l 7058e497f3 Generic: DNS response check implemented 2016-08-31 18:59:37 +03:00
ar13l 99ec56f37b Generic: implementation of detection techniques using VEDetection interface 2016-08-31 16:46:01 +03:00