admin/CheckPointSW-InviZzzible
1
0
Fork 0
mirror of https://github.com/CheckPointSW/InviZzzible synced 2026-06-08 10:35:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 4f762e2c19 fix: pin GitHub Actions to full SHA (CLOUDEVOPS-4942) fix/CLOUDEVOPS-4942-pin-all-versions-to-hash github-actions[bot] 2026-03-31 10:36:43 +00:00
  • c515e8929a Merge pull request #15 from chkp-alexeybu/ab_default_configs master Alexander Chailytko 2022-04-05 14:05:23 +03:00
  • f6a9ebceef Added flexible build configurations to enable running without command line Removed configuration file for the HTML report template Scripts migrated to Python 3 chkp-alexeybu 2022-04-04 16:57:35 +03:00
  • 9e0d2e6b1f Merge pull request #13 from CheckPointSW/integrate-sourceguard Alexander Chailytko 2022-03-25 14:41:25 +03:00
  • 6826eb33d8 Integrate SourceGuard Code Analysis Ron Izraeli 2022-03-15 14:21:17 +02:00
  • d6fa72cb4d Cuckoo: check for invalid hook of NtLoadKeyEx added Cuckoo: lack of argument checks in NtDelayExecution evasion added chkp-alexeybu 2022-02-07 14:22:33 +03:00
  • 17f2a5a483 Fixed indents in configuration files chkp-ramanl 2021-05-04 12:39:36 +03:00
  • 3f6e124a15 VMware: added check of physical display adapter chkp-ramanl 2021-05-04 12:38:47 +03:00
  • 38a153824f Merge pull request #9 from chkp-yaroslavh/master Alexander Chailytko 2019-12-18 17:33:38 +03:00
  • 3f4295bb1b Generic: AudioDeviceAbsence has been added - checks if an audio device is attached to the PC chkp-yaroslavh 2019-11-14 16:06:28 +03:00
  • 4ebc25b651 Scoring: implemented scoring system for different categories of evasion techniques based on their prevalence and severity chkp-ramanl 2019-06-20 17:42:54 +03:00
  • b41629a0bf VEDetection: added user names to be checked as means of detection chkp-ramanl 2019-01-31 16:16:06 +03:00
  • 2602c5fae5 Merge pull request #7 from chkp-aliaksandrt/improvements-dec2018 Alexander Chailytko 2019-01-02 17:58:10 +03:00
  • 010106480d KVM: CPU Hypervisor and Vendor IDs check has been implemented Generic: BigRamAlloc has been added - tries to allocate big amount of RAM Generic: UserInputActivity has been added - evasion which utilizes GetLastInputInfo API function Generic: DiskEnum Registry Key chech has been added - checks System\CurrentControlSet\Services\Disk\Enum reg key for value 0=*virtual Generic: Sandbox-like filename check has been added - checks if current file has any of the following patterns in its path: C:\SELF.EXE, .*self\.*, .*sample.*, .*sandbox.*, .*virus.*, .*malware.* Generic: Processes of AV and research tools check has been added - checks if any of the following processes are running: avgui.exe, avastsvc.exe, avastui.exe, procmon.exe, procmon64.exe, procexp.exe, procexp64.exe, ollydbg.exe, windbg.exe, avp.exe, bdagent.exe, bdwtxag.exe, dwengine.exe Generic: Max Processes number check has been added (disabled) Generic: Process with a long name check has been added Hyper-V: CPU HypervisorID check has been added Parallels: CPU HypervisorID check has been added QEMU: QEMU DiskEnum Registry Key has been added Sandboxie: Injected sbiedll module check has been added VMware: VMWare DiskEnum Registry Key check has been added Xen: CPU VendorID check has been added Xen: CPU HypervisorID check has been added Xen: DiskEnum Registry Key check has been added Some build warnings have been fixed chkp-aliaksandrt 2019-01-02 17:45:51 +03:00
  • 1f5d6f16c3 Added link to video recording from ShmooCon 2017 Alexander Chailytko 2018-10-03 12:28:43 +03:00
  • 02ea69cff4 Cuckoo: ResultserverConnection detection technique implemented Alexey Bukhteyev 2018-04-10 10:51:13 +03:00
  • 3e4e5a36f6 Vbox: added virtual devices to be checked as means of detection Vbox: added MAC address to be checked as means of detection VMware: added file names to be checked as means of detection VMware: added registry paths and values to be checked as means of detection VMware: added running processes to be checked as means of detection BOCHS: implementation of detection techniques using VEDetection interface Hyper-V: implementation of detection techniques using VEDetection interface JoeBox: implementation of detection techniques using VEDetection interface Parallels: implementation of detection techniques using VEDetection interface QEMU: implementation of detection techniques using VEDetection interface Sandboxie: implementation of detection techniques using VEDetection interface VirtualPC: implementation of detection techniques using VEDetection interface Wine: implementation of detection techniques using VEDetection interface Xen: implementation of detection techniques using VEDetection interface Miscellaneous sandboxes: implementation of detection techniques using VEDetection interface Added config for BOCHS evasions: checking registry Added config for Hyper-V evasions: checking registry, global objects in OS Added config for JoeBox evasions: checking registry, running processes Added config for Parallels evasions: checking filesystem, registry, firmware tables, running processes, global objects in OS Added config for QEMU evasions: checking registry, disk name Added config for Sandboxie evasions: checking registry, global objects in OS Added config for VirtualPC evasions: checking registry, firmware tables, disk name, running processes, global devices in OS Added config for Wine evasions: checking registry Added config for Xen evasions: checking registry, running processes Added config for miscellaneous VM and sandboxes evasions Generic: fixed bug in raw mouse activity check gitignore: updated Alexey Bukhteyev 2018-04-09 17:35:58 +03:00
  • 46ca97a51d Generic: raw mouse activity check implemented Stanislav Skuratovich 2017-08-04 17:27:04 +03:00
  • 54516d034b Generic: DNS response check servers changed Generic: PerformanceCounter detection technique implemented Stanislav Skuratovich 2017-08-03 18:28:50 +03:00
  • d67a70942d Cuckoo: SocketTimeout detection technique implemented VEDetection: generic interface for drive model vendor added Stanislav Skuratovich 2017-08-03 15:04:53 +03:00
  • 4732ecd14e OpenProcess condition bug fix Stanislav Skuratovich 2017-03-03 12:57:26 +03:00
  • 01552597f4 Cuckoo: TickCount integrity check cast bug fixed ar13l 2017-01-24 14:24:29 +03:00
  • 82597eb731 Cuckoo: TickCount integrity check implemented ar13l 2017-01-19 16:20:24 +03:00
  • b3170a3d71 Cuckoo: DelayInterval detection technique implemented ar13l 2017-01-19 11:51:07 +03:00
  • dcec8b7d1a Adding ShmooCon 2017 to presentations list MalwareResearch 2017-01-18 15:08:23 +03:00
  • 774b5cc6dd New slides added ar13l 2017-01-18 14:56:55 +03:00
  • da906a1e90 Adjusted repository name, links and credits MalwareResearch 2017-01-11 16:29:28 +03:00
  • 8b60a13fde VEDetection: DNS module domain composition changed ar13l 2017-01-10 14:32:05 +03:00
  • 5231ee6e96 VMWare: i/o ports detection implemented ar13l 2017-01-10 13:31:42 +03:00
  • e70f52d728 VEDetection: generic interface for drive model implemented ar13l 2017-01-09 18:02:15 +03:00
  • 3defb69b57 Cuckoo: SuspendedThread evasion technique implemented ar13l 2017-01-09 13:17:28 +03:00
  • 5372b543d2 Cuckoo: Dead Analyzer evasion technique implemented ar13l 2017-01-06 19:56:22 +03:00
  • 43dd12b54a Cuckoo: differentiation between real and sandbox machines implemented while performing evasions (function hooks are used). If hooks are fixed. then another method should be used. ar13l 2017-01-06 17:39:08 +03:00
  • 50ba964057 Update README.md MalwareResearch 2017-01-04 17:21:20 +03:00
  • d3d6a9cc91 Logo file added MalwareResearch 2017-01-04 15:58:46 +03:00
  • 8a1b52c640 Uninitialized dns_interface variable bug fixed ar13l 2016-12-22 16:01:12 +03:00
  • 78c0eb8a27 Detect by Wireshark device moved to Generic ar13l 2016-12-22 12:00:26 +03:00
  • 2f7c27f38e VEDetection: DNS module is used now for user notification about detection technique result ariel19 2016-12-21 15:19:30 +03:00
  • 381d2ea96d Update README.md MalwareResearch 2016-10-13 15:40:01 +03:00
  • e2f809661f Slides from Virus Bulletin 2016 conference link added MalwareResearch 2016-10-10 14:37:05 +03:00
  • f7f9b2e452 VB2016 slides added ar13l 2016-10-10 14:27:49 +03:00
  • 96b973326f Update README.md MalwareResearch 2016-10-06 09:21:31 -06:00
  • bcbce3f150 Update README.md MalwareResearch 2016-10-05 23:44:09 +03:00
  • 21627d2401 Update README.md MalwareResearch 2016-10-05 23:29:22 +03:00
  • 45ff60b4f3 Original parameters for debugging purpose restored ar13l 2016-10-03 13:36:18 +03:00
  • 215fbe6ad9 Cuckoo: moving date/time tampering technique to Generic ar13l 2016-10-03 13:29:45 +03:00
  • b38f519dcf DEBUG configuration removed ar13l 2016-09-29 18:15:52 +03:00
  • 39e2ff7b54 Fixing bug that occurs while compiling in DEBUG mode ar13l 2016-09-29 17:59:51 +03:00
  • a1e0e32ec0 Config: detection/evasion techniques description added ar13l 2016-09-29 17:11:43 +03:00
  • 90c6913187 Cuckoo: delays accumulation detection technique reimplemented ar13l 2016-09-28 17:59:02 +03:00
  • 5bfa26a4b9 Cuckoo: detection by configuration file technique reimplemented ar13l 2016-09-28 15:26:51 +03:00
  • 0d7c0d5028 Main: report is generated in case of configuration files absence during execution ar13l 2016-09-20 18:42:08 +03:00
  • d25dcc416c Main: default mode (without parameters) executes Cuckoo Sandbox environment checks ar13l 2016-09-20 17:16:43 +03:00
  • 4a9c5218a0 VEDetection: File module is now writes bytes to detection file in order to be visible in behavioral analysis ar13l 2016-09-20 15:11:01 +03:00
  • 98594dea9b VEDetection: File module is used now for user notification about detection technique result ar13l 2016-09-19 13:22:24 +03:00
  • 5caf598a1f Report placeholders' changes ar13l 2016-09-19 11:32:59 +03:00
  • c871f84df5 Cuckoo: EXCEPTION_MAXCOUNT adopted ar13l 2016-09-02 11:10:25 +03:00
  • a8a12105ff VEDetection: generic interface for the disks checks implemented ar13l 2016-09-01 18:15:12 +03:00
  • 2b1ecfbb58 Report: field Type added Generic: dummy sleep patch bug fixed ar13l 2016-09-01 17:29:23 +03:00
  • 15a9201c4b VEDetection: generic interface for the hared folders checks implemented VBOX: detection techniques added VMware: detection techniques added ar13l 2016-09-01 15:35:30 +03:00
  • 1088bd53b9 VEDetection: generic interface for the windows checks implemented ar13l 2016-09-01 14:52:11 +03:00
  • 65a6c16892 VMware: adding additional vm checks ar13l 2016-09-01 14:10:02 +03:00
  • 2bc45c73de Config: recursive field added ar13l 2016-09-01 13:33:34 +03:00
  • 48ce0d7feb Config: value_name now support arrays Code: refactoring ar13l 2016-09-01 12:09:24 +03:00
  • 56e34346d3 VEDetection: generic interface for cpuid vendor check implemented ar13l 2016-08-31 20:17:15 +03:00
  • 5d97a619e1 VEDetection: generic interface for cpuid vendor check implemented ar13l 2016-08-31 20:16:15 +03:00
  • 7058e497f3 Generic: DNS response check implemented ar13l 2016-08-31 18:59:37 +03:00
  • 57c91d81bc Cuckoo: time tampering sandbox detection method implemented ar13l 2016-08-31 17:51:48 +03:00
  • 99ec56f37b Generic: implementation of detection techniques using VEDetection interface ar13l 2016-08-31 16:46:01 +03:00
  • 90a15e6999 VEDetection: Report module is used now for the report generation ar13l 2016-08-31 13:35:29 +03:00
  • 0b06377a0e Report: dummy module that is responsible for HTML report generation implemented ar13l 2016-08-31 12:47:41 +03:00
  • 0f4ae91f37 Logger: colored console implemented Main: banner added ar13l 2016-08-30 19:55:27 +03:00
  • 065ba141bf VBOX: implementation of detection techniques using VEDetection interface ar13l 2016-08-30 18:16:29 +03:00
  • d7c9b96ab0 VEDetection: generic interface for directory objects checks implemented ar13l 2016-08-30 17:00:26 +03:00
  • 14fc80d815 Config: enabled field added ar13l 2016-08-30 15:45:35 +03:00
  • 515f51ae2b VEDetection: VEDetection: generic interface for different firmware types checks implemented VMWare: custom checks implemented (port, NDIS_WanIP) ar13l 2016-08-30 14:32:49 +03:00
  • 9c5b1f306c Config: support for different registry types added ar13l 2016-08-29 21:48:49 +03:00
  • 1ee0ab8958 VEDetection: generic interface for the adapters check implemented ar13l 2016-08-29 20:38:57 +03:00
  • 434b4cf75e Helper: fixing bug when 32-bit process on 32-bit OS fails due to unavailable fs redirection ar13l 2016-08-29 20:22:13 +03:00
  • 781dd4b5e8 Config: support for arrays added ar13l 2016-08-29 20:11:18 +03:00
  • 7ff1d39584 VEDetection: generic interface for the macs check implemented ar13l 2016-08-29 19:26:27 +03:00
  • dde47d8946 VEDetection: generic interface for the registries, files, devices, processes checks implemented VMWare: implementation of detection techniques using VEDetection interface Config: new fields added ar13l 2016-08-29 17:00:27 +03:00
  • a36ca08119 JSON: tiny json implemented VEDetection: generic interface for reports grabbing and sandbox/virtual environments implemented Logger: simple logger implemented Cuckoo: implementation according to VEDetection interface Main: generic working modes parsing implemented ar13l 2016-08-26 13:06:39 +03:00
  • 42db85cc14 Cuckoo: raised exceptions detection handling ar13l 2016-08-25 12:36:01 +03:00
  • 2998c43f71 Cuckoo: Agent presence detection timeout for network operations added ar13l 2016-08-24 17:14:33 +03:00
  • 9260563277 Cuckoo: WMI OpenProcess flag changed to PROCESS_QUERY_INFORMATION ar13l 2016-08-24 14:45:58 +03:00
  • 6db40683e7 boost LICENSE added ar13l 2016-08-24 12:08:06 +03:00
  • 73c1db7360 Cuckoo: Task Scheduler escape implemented (Windows Vista and upper) ar13l 2016-08-24 12:06:52 +03:00
  • 0e8abc9037 Cuckoo: raised exceptions detection implemented Cuckoo: WMI escape implemented Cuckoo: detection by agent.py implemented Cuckoo: detection based on specific event presence implemented Cuckoo: whitelisted process detection implemented Cuckoo: reused pid detection implemented Cuckoo: configuration artifacts detection implemented Cuckoo: unbalanced stack detection implemented Cuckoo: INFINITE delay skip detection implemented Cuckoo: delays accumulation detection implemented Cuckoo: functions hooking detection implemented Cuckoo: agent.py artifacts detection implemented ar13l 2016-08-22 17:36:28 +03:00
  • ecd5593557 CHANGELOG added ar13l 2016-08-22 17:24:04 +03:00
  • 4d717c553a Initial commit MalwareResearch 2016-06-10 16:01:05 +03:00