mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
Alexey Bukhteyev
3e4e5a36f6
Vbox: added MAC address to be checked as means of detection VMware: added file names to be checked as means of detection VMware: added registry paths and values to be checked as means of detection VMware: added running processes to be checked as means of detection BOCHS: implementation of detection techniques using VEDetection interface Hyper-V: implementation of detection techniques using VEDetection interface JoeBox: implementation of detection techniques using VEDetection interface Parallels: implementation of detection techniques using VEDetection interface QEMU: implementation of detection techniques using VEDetection interface Sandboxie: implementation of detection techniques using VEDetection interface VirtualPC: implementation of detection techniques using VEDetection interface Wine: implementation of detection techniques using VEDetection interface Xen: implementation of detection techniques using VEDetection interface Miscellaneous sandboxes: implementation of detection techniques using VEDetection interface Added config for BOCHS evasions: checking registry Added config for Hyper-V evasions: checking registry, global objects in OS Added config for JoeBox evasions: checking registry, running processes Added config for Parallels evasions: checking filesystem, registry, firmware tables, running processes, global objects in OS Added config for QEMU evasions: checking registry, disk name Added config for Sandboxie evasions: checking registry, global objects in OS Added config for VirtualPC evasions: checking registry, firmware tables, disk name, running processes, global devices in OS Added config for Wine evasions: checking registry Added config for Xen evasions: checking registry, running processes Added config for miscellaneous VM and sandboxes evasions Generic: fixed bug in raw mouse activity check gitignore: updated
InviZzzible
Contributed By Check Point Software Technologies LTD.
Programmed by Stanislav Skuratovich.
Presented at:
- ShmooCon 2017 by Alexander Chailytko and Stanislav Skuratovich.
- Virus Bulletin 2016 by Alexander Chailytko and Stanislav Skuratovich.
Overview
InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them. Also, you can add and expand existing techniques yourself even without modifying the source code.
Supported environments
- Cuckoo Sandbox
- Joe Sandbox
- VMWare virtualization products
- VirtualBox
- Hyper-V
- Parallels
- QEMU
- BOCHS
- Xen
- VirtualPC
- Sandboxie
- Wine
Features
- Generic tool that covers a lot of different virtual environment detection techniques and proposes fixes for that.
- Easily extendable; support for new virtual environments can be added quickly.
- As Cuckoo Sandbox is the most prevalent tool used for automated malware analysis, we include the detections of it as well.
- Ability to introduce new detection techniques not through modifying the source code, but using the JSON configuration files, so the whole community can contribute towards the development of that tool.
- User-friendly reports about the checked environment that can be shared within the organization among the purely technical guys as well as higher management.
Credits
- Aliaksandr Trafimchuk
- Alexey Bukhteyev
- Raman Ladutska
- VMDE project
- Pafish project