mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
Stanislav Skuratovich
58 lines
2.4 KiB
Plaintext
58 lines
2.4 KiB
Plaintext
{
|
|
"SystemUptime": {
|
|
"description": "Check if system uptime is large enough.",
|
|
"countermeasures": "Add some value to number of ticks returned from GetTickCount function.",
|
|
"enabled": "yes"
|
|
},
|
|
"RAM": {
|
|
"description": "Check size of physical memory is large enough.",
|
|
"countermeasures": "Patch/Hook NtQuerySystemInformtaion to return new number of PhysicalPages in SystemBasicInformation. Patch NumberOfPhysicalPages in KUSER_SHARED_DATA.",
|
|
"enabled": "yes"
|
|
},
|
|
"DeviceNPF_NDIS": {
|
|
"description": "Check if access to `\\\\.\\NPF_NdisWanIp' device returns specific error code.",
|
|
"countermeasures": "Disable access to `\\\\.\\NPF_NdisWanIp' device for the not-trusted processes.",
|
|
"type": "custom",
|
|
"enabled": "yes"
|
|
},
|
|
"DriveSize": {
|
|
"description": "Check if drive size is large enough.",
|
|
"countermeasures": "Filter IRP device control requests to \\Device\\HarddiskN withy specific CTL-codes (DRIVE_GEOMETRY_EX, DRIVE_LAYOUT_EX, PARTITION_INFO_EX).",
|
|
"enabled": "yes"
|
|
},
|
|
"DiskSize": {
|
|
"description": "Check if C: disk size is large enough.",
|
|
"countermeasures": "Patch/Hook NtQueryVolumeInformationFile to handle FileFsSizeInformation and FileFsFullSizeInformation classes if handle points to \\Device\\HarddiskVolumeN.",
|
|
"enabled": "yes"
|
|
},
|
|
"MouseActive": {
|
|
"description": "Check if there is some mouse activity.",
|
|
"countermeasures": "Implement human module that is responsible for mouse movements.",
|
|
"enabled": "yes"
|
|
},
|
|
"SleepDummyPatch": {
|
|
"description": "Check if Sleep-family functions are patched in dummy way.",
|
|
"countermeasures": "Patch Sleep-family and other dependent functions in appropriate way.",
|
|
"enabled": "yes"
|
|
},
|
|
"ProcessorsCount": {
|
|
"description": "Check if number of processors/cores is larger than 1.",
|
|
"countermeasures": "Assign two or more cores for Virtual Machine. Patch/Hook NtCreateThread to assign specific core for each new thread.",
|
|
"enabled": "yes"
|
|
},
|
|
"DnsResponse": {
|
|
"description": "Check DNS response for specific domains.",
|
|
"countermeasures": "Emulate DNS server responses in appropriate way.",
|
|
"enabled": "yes"
|
|
},
|
|
"TimeTampering": {
|
|
"description": "Check if delays are handled correctly comparing to web page time.",
|
|
"countermeasures": "Emulate network responses correctly.",
|
|
"enabled": "yes"
|
|
},
|
|
"PerformanceCounter": {
|
|
"description": "Check if delays are consistent with performance counter.",
|
|
"countermeasures": "Complex.",
|
|
"enabled": "yes"
|
|
}
|
|
} |