mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
chkp-ramanl
84 lines
2.4 KiB
Plaintext
84 lines
2.4 KiB
Plaintext
{
|
|
"Side Processes": {
|
|
"description": "Check if one of the following processe is running: `WPE Pro.exe'.",
|
|
"countermeasures": "Exclude `WPE Pro.exe' process from enumeration or terminate it.",
|
|
"type": "process",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": "WPE Pro.exe"
|
|
},
|
|
"score": 10
|
|
},
|
|
"Sandbox Registry Keys": {
|
|
"description": "Check if `HKLM\\Software\\Classes\\Folder\\shell\\sandbox' Registry Key is present.",
|
|
"countermeasures": "Remove `HKLM\\Software\\Classes\\Folder\\shell\\sandbox' Registry Key.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": "Software\\Classes\\Folder\\shell\\sandbox"
|
|
},
|
|
"score": 10
|
|
},
|
|
"Sandbox Specific Files": {
|
|
"description": "Check if the following directory is present: `c:\\analysis\\'. Check if any of the following files are present: `C:\\Symbols\\aagmmc.pdb', `C:\\take_screenshot.ps1', `C:\\loaddll.exe', `C:\\email.doc', `C:\\email.htm', `C:\\123\\email.doc', `C:\\123\\email.docx', `C:\\a\\foobar.bmp', `C:\\a\\foobar.doc', `C:\\a\\foobar.gif'.",
|
|
"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
|
|
"type": "file",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": [
|
|
"c:\\analysis\\",
|
|
"C:\\Symbols\\aagmmc.pdb",
|
|
"C:\\take_screenshot.ps1",
|
|
"C:\\loaddll.exe",
|
|
"C:\\email.doc",
|
|
"C:\\email.htm",
|
|
"C:\\123\\email.doc",
|
|
"C:\\123\\email.docx",
|
|
"C:\\a\\foobar.bmp",
|
|
"C:\\a\\foobar.doc",
|
|
"C:\\a\\foobar.gif"
|
|
]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Sandbox User Names": {
|
|
"description": "Check if user name is one of the following: `Wilbert', `admin', `John Doe', `John'.",
|
|
"countermeasures": "Change user name.",
|
|
"type": "user_name",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": [
|
|
"Wilbert",
|
|
"admin",
|
|
"John Doe",
|
|
"John"
|
|
]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Sandbox Computer Names": {
|
|
"description": "Check if computer name is one of the following: `TEQUILABOOMBOOM', `KLONE_X64-PC'.",
|
|
"countermeasures": "Change computer name.",
|
|
"type": "computer_name",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": [
|
|
"TEQUILABOOMBOOM",
|
|
"KLONE_X64-PC"
|
|
]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Sandbox Host Names": {
|
|
"description": "Check if host name is the following: `SystemIT'.",
|
|
"countermeasures": "Change host name.",
|
|
"type": "host_name",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": "SystemIT"
|
|
},
|
|
"score": 10
|
|
}
|
|
} |