CheckPointSW-InviZzzible/config/generic.conf

{
	"SystemUptime": {
		"description": "Check if system uptime is large enough.",
		"countermeasures": "Add some value to number of ticks returned from GetTickCount function.",
		"enabled": "yes",
		"score": 7
	},
	"RAM": {
		"description": "Check size of physical memory is large enough.",
		"countermeasures": "Patch/Hook NtQuerySystemInformtaion to return new number of PhysicalPages in SystemBasicInformation. Patch NumberOfPhysicalPages in KUSER_SHARED_DATA.",
		"enabled": "yes",
		"score": 5
	},
	"BigRamAlloc": {
		"description": "Allocate big amount of memory.",
		"countermeasures": "Give the VM/machine more RAM or make sure you have enabled swap file",
		"enabled": "yes",
		"score": 4
	},
	"DeviceNPF_NDIS": {
		"description": "Check if access to `\\\\.\\NPF_NdisWanIp' device returns specific error code.",
		"countermeasures": "Disable access to `\\\\.\\NPF_NdisWanIp' device for the not-trusted processes.",
		"type": "custom",
		"enabled": "yes",
		"score": 8
	},
	"DriveSize": {
		"description": "Check if drive size is large enough.",
		"countermeasures": "Filter IRP device control requests to \\Device\\HarddiskN with specific CTL-codes (DRIVE_GEOMETRY_EX, DRIVE_LAYOUT_EX, PARTITION_INFO_EX).",
		"enabled": "yes",
		"score": 9
	},
	"DiskSize": {
		"description": "Check if C: disk size is large enough.",
		"countermeasures": "Patch/Hook NtQueryVolumeInformationFile to handle FileFsSizeInformation and FileFsFullSizeInformation classes if handle points to \\Device\\HarddiskVolumeN.",
		"enabled": "yes",
		"score": 9
	},
	"MouseActive": {
		"description": "Check if there is some mouse activity.",
		"countermeasures": "Implement human module that is responsible for mouse movements.",
		"enabled": "yes",
		"score": 6
	},
	"MouseRawActive": {
		"description": "Check if there is mouse raw activity.",
		"countermeasures": "Implement HID driver for mouse movement.",
		"enabled": "yes",
		"score": 6
	},
	"UserInputActivity": {
		"description": "Check if there is a user input activity.",
		"countermeasures": "Implement HID driver for mouse movement, clicks, send keyboard input.",
		"enabled": "yes",
		"score": 6
	},
	"SleepDummyPatch": {
		"description": "Check if Sleep-family functions are patched in dummy way.",
		"countermeasures": "Patch Sleep-family and other dependent functions in appropriate way.",
		"enabled": "yes",
		"score": 4
	},
	"ProcessorsCount": {
		"description": "Check if number of processors/cores is larger than 1.",
		"countermeasures": "Assign two or more cores for Virtual Machine. Patch/Hook NtCreateThread to assign specific core for each new thread.",
		"enabled": "yes",
		"score": 6
	},
	"DnsResponse": {
		"description": "Check DNS response for specific domains.",
		"countermeasures": "Emulate DNS server responses in appropriate way.",
		"enabled": "yes",
		"score": 3
	},
	"TimeTampering": {
		"description": "Check if delays are handled correctly comparing to web page time.",
		"countermeasures": "Emulate network responses correctly.",
		"enabled": "yes",
		"score": 3
	},
	"PerformanceCounter": {
		"description": "Check if delays are consistent with performance counter.",
		"countermeasures": "Complex.",
		"enabled": "yes",
		"score": 10
	},
	"AudioDeviceAbsence": {
		"description": "Check if an audio device is absent",
		"countermeasures": "Add an audio device to a virtual machine",
		"enabled": "yes",
		"score": 3
	},
	"DiskEnum Registry Key": {
		"description": "Check if `System\\CurrentControlSet\\Services\\Disk\\Enum' Registry Key has value `0'=`*virtual*'.",
		"countermeasures": "Patch the registry to hide this indicator",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "System\\CurrentControlSet\\Services\\Disk\\Enum",
			"value_name": "0",
			"value_data": "virtual"
		},
		"score": 10
	},
	"Sandbox-like named file": {
		"description": "Checks if the current file has any of the following patterns in its path: `C:\\SELF.EXE', `.*self\\.*', `.*sample.*', `.*sandbox.*', `.*virus.*', `.*malware.*'",
		"countermeasures": "Randomize file name or give it a human-readable name",
		"type": "exe_path_pattern",
		"enabled": "yes",
		"arguments": {
			"pattern": [
				"C:\\\\SELF\\.EXE",
				".*self\\..*",
				".*sample.*",
				".*sandbox.*",
				".*virus.*",
				".*malware.*"
			]
		},
		"score": 10
	},
	"AV and Research tools Processes": {
		"description": "Check if one of the following processes is running: `avgui.exe', `avastsvc.exe', `avastui.exe', `procmon.exe', `procmon64.exe', `procexp.exe', `procexp64.exe', `ollydbg.exe', `windbg.exe', `avp.exe', `bdagent.exe', `bdwtxag.exe', `dwengine.exe'",
		"countermeasures": "Exclude `avgui.exe', `avastsvc.exe', `avastui.exe', `procmon.exe', `procmon64.exe', `procexp.exe', `procexp64.exe', `ollydbg.exe', `windbg.exe', `avp.exe', `bdagent.exe', `bdwtxag.exe', `dwengine.exe' processes from enumeration or terminate them.",
		"type": "process",
		"enabled": "yes",
		"arguments": {
			"name": [
				"avgsvc.exe",
				"avgui.exe",
				"avastsvc.exe",
				"avastui.exe",
				"procmon.exe",
				"procmon64.exe",
				"procexp.exe",
				"procexp64.exe",
				"ollydbg.exe",
				"windbg.exe",
				"avp.exe",
				"bdagent.exe",
				"bdwtxag.exe",
				"dwengine.exe"
			]
		},
		"score": 10
	},
	"Max Processes number": {
		"description": "Check if there are more than N processes running",
		"countermeasures": "Prevent creation of so many processes via some technique like process hiding or change your environment",
		"type": "max_processes_number",
		"enabled": "no",
		"arguments": {
			"number": 500
		},
		"score": 3
	},
	"Existence of a process with long name": {
		"description": "Check if there is at least one running process with long name (some sandboxes give SHA256 hash name to the running file)",
		"countermeasures": "Randomize file name or give it a human-readable name",
		"type": "process_with_long_name",
		"enabled": "yes",
		"arguments": {
			"number": 64
		},
		"score": 3
	}
}