mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
Alexey Bukhteyev
3e4e5a36f6
Vbox: added MAC address to be checked as means of detection VMware: added file names to be checked as means of detection VMware: added registry paths and values to be checked as means of detection VMware: added running processes to be checked as means of detection BOCHS: implementation of detection techniques using VEDetection interface Hyper-V: implementation of detection techniques using VEDetection interface JoeBox: implementation of detection techniques using VEDetection interface Parallels: implementation of detection techniques using VEDetection interface QEMU: implementation of detection techniques using VEDetection interface Sandboxie: implementation of detection techniques using VEDetection interface VirtualPC: implementation of detection techniques using VEDetection interface Wine: implementation of detection techniques using VEDetection interface Xen: implementation of detection techniques using VEDetection interface Miscellaneous sandboxes: implementation of detection techniques using VEDetection interface Added config for BOCHS evasions: checking registry Added config for Hyper-V evasions: checking registry, global objects in OS Added config for JoeBox evasions: checking registry, running processes Added config for Parallels evasions: checking filesystem, registry, firmware tables, running processes, global objects in OS Added config for QEMU evasions: checking registry, disk name Added config for Sandboxie evasions: checking registry, global objects in OS Added config for VirtualPC evasions: checking registry, firmware tables, disk name, running processes, global devices in OS Added config for Wine evasions: checking registry Added config for Xen evasions: checking registry, running processes Added config for miscellaneous VM and sandboxes evasions Generic: fixed bug in raw mouse activity check gitignore: updated
31 lines
1018 B
Plaintext
31 lines
1018 B
Plaintext
{
|
|
"Side Processes": {
|
|
"description": "Check if one of the following processe is running: `WPE Pro.exe'.",
|
|
"countermeasures": "Exclude `WPE Pro.exe' process from enumeration or terminate it.",
|
|
"type": "process",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": "WPE Pro.exe"
|
|
}
|
|
},
|
|
"Sandbox Registry Keys": {
|
|
"description": "Check if `HKLM\\Software\\Classes\\Folder\\shell\\sandbox' Registry Key is present.",
|
|
"countermeasures": "Remove `HKLM\\Software\\Classes\\Folder\\shell\\sandbox' Registry Key.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": "Software\\Classes\\Folder\\shell\\sandbox"
|
|
}
|
|
},
|
|
"Sandbox Specific Files": {
|
|
"description": "Check if the following directory is present: `c:\\analysis\\'.",
|
|
"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
|
|
"type": "file",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": "c:\\analysis\\"
|
|
}
|
|
}
|
|
} |