CheckPointSW-InviZzzible/config/cuckoo.conf

{
	"InvalidHook": {
		"description": "Call NtLoadKeyEx and check if ESP value is correct.",
		"countermeasures": "Fix NtLoadKeyEx hook.",
		"enabled": "yes",
		"score": 3
	},
	"LackOfArgumentChecks": {
		"description": "Call NtDelayExecution with invalid arguments and check if it returns the expected status code.",
		"countermeasures": "Add necessary argument checks in NtDelayExecution and similar functions.",
		"enabled": "yes",
		"score": 3
	},
	"UnbalancedStack": {
		"description": "Check if canaries at the top of the stack remains the same after function call.",
		"countermeasures": "Stack adjusting before function call. Kernel-mode hooking.",
		"enabled": "yes",
		"score": 3
	},
	"InfiniteDelay": {
		"description": "Check if INFINITE delay is skipped due to sleep skipping.",
		"countermeasures": "Adding conditional check for INFINITE delay.",
		"enabled": "yes",
		"score": 6
	},
	"DelaysAccumulation": {
		"description": "Check if delays accumulation is valid using get time functions.",
		"countermeasures": "Complex.",
		"enabled": "yes",
		"score": 3
	},
	"SocketTimeout": {
		"description": "Check if socket timeout takes the same amount of time as sleep delay.",
		"countermeasures": "Complex.",
		"enabled": "yes",
		"score": 3
	},
	"FunctionHooks": {
		"description": "Check if functions are hooked.",
		"countermeasures": "Kernel-mode hooking.",
		"enabled": "yes",
		"score": 10
	},
	"AgentArtifacts": {
		"description": "Check if agent artifacts are present in the system.",
		"countermeasures": "Use random name for the Analyzer and configuration files. Pass configuration file name as an argument for the Analyzer module. Hide using kernel-mode driver.",
		"enabled": "yes",
		"score": 10
	},
	"CuckoomonConfiguration": {
		"description": "Check if cuckoomon configuration files are present in the system.",
		"countermeasures": "Write configuration data to allocated memory in the tracked process. Inject Monitor code to tracked process. Start initialization of Monitor using CreateRemoteThread/QueueUserAPC with address of configuration data as parameter.",
		"enabled": "yes",
		"score": 10
	},
	"WhitelistedProcess": {
		"description": "Check if whitelisted process is not tracked.",
		"countermeasures": "Remove all processes from the whitelist.",
		"enabled": "yes",
		"score": 10
	},
	"EventName": {
		"description": "Check if specific event name is present in the system (Relevant for CuckooMon).",
		"countermeasures": "Use pipe command for notification (Implemented in CuckooMonitor).",
		"enabled": "yes",
		"score": 3
	},
	"RaisedExceptions": {
		"description": "Check if after raising specified number of exceptions, process exits with specific error code.",
		"countermeasures": "Remove ExitProcess from the log_exception function after specified number of exceptions has occured.",
		"enabled": "yes",
		"score": 3
	},
	"WMIProcess": {
		"description": "Check if process started using WMI is not tracked.",
		"countermeasures": "Add suport for tracking processes started using WMI.",
		"enabled": "yes",
		"score": 9
	},
	"TaskSchedulerProcess": {
		"description": "Check if process started using Task Scheduler is not tracked. Currently there is no support for Windows XP and older.",
		"countermeasures": "Add support for tracking processes started using Task Scheduler.",
		"enabled": "yes",
		"score": 9
	},
	"PidReuse": {
		"description": "Check if reused pid for the process is not tracked.",
		"countermeasures": "Perform removal of PID from the process_list after pipe KILL command was received.",
		"enabled": "yes",
		"score": 4
	},
	"AgentListener": {
		"description": "Check if agent.py is present in the system.",
		"countermeasures": "Block connections that are coming from the local interfaces.",
		"enabled": "yes",
		"score": 10
	},
	"SuspendedThread": {
		"description": "Check if helper thread, created in suspended process is not monitored.",
		"countermeasures": "Complex.",
		"enabled": "yes",
		"score": 9
	},
	"DelayInterval": {
		"description": "Check if DelayInterval value has changed after querying NtDelayExecution service.",
		"countermeasures": "Create a copy of DelayInterval argument in hook.",
		"enabled": "yes",
		"score": 3
	},
	"TickCount": {
		"description": "Check if Tick Count value returned from the function is the same as in KUSER_SHARED_DATA.",
		"countermeasures": "Complex.",
		"enabled": "yes",
		"score": 3
	},
	"ResultserverConnection": {
		"description": "Check if there is an active TCP connection with the destination port 2042.",
		"countermeasures": "Change the Resultserver port number.",
		"enabled": "yes",
		"score": 3
	},
	"DeadAnalyzer": {
		"description": "Kill Analyzer process and check if created process is not tracked.",
		"countermeasures": "Hide Agent and Analyzer python executables before analysis start using driver.",
		"enabled": "yes",
		"score": 6
	}
}