GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → 0xcpu → bonomen

0xcpu / bonomen

Licence: GPL-3.0 license
BONOMEN - Hunt for Malware Critical Process Impersonation

Programming Languages

rust
11053 projects

Labels

windowsunixmalware-analysismalware-research

Projects that are alternatives of or similar to bonomen

Nauz File Detector
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Stars: ✭ 146 (+247.62%)
Mutual labels:  malware-analysis, malware-research
Apkfile
Android app analysis and feature extraction library
Stars: ✭ 190 (+352.38%)
Mutual labels:  malware-analysis, malware-research
Antidebugging
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
Stars: ✭ 161 (+283.33%)
Mutual labels:  malware-analysis, malware-research
Malware Analysis Writeups
A repository of my completed writeups, along with the samples themselves.
Stars: ✭ 127 (+202.38%)
Mutual labels:  malware-analysis, malware-research
WeDefend
⛔🛡️ WeDefend - Monitor and Protect Windows from Remote Access Trojan
Stars: ✭ 23 (-45.24%)
Mutual labels:  malware-analysis, malware-research
Visualize logs
A Python library and command line tools to provide interactive log visualization.
Stars: ✭ 128 (+204.76%)
Mutual labels:  malware-analysis, malware-research
Detect It Easy
Program for determining types of files for Windows, Linux and MacOS.
Stars: ✭ 2,982 (+7000%)
Mutual labels:  malware-analysis, malware-research
Sojobo
A binary analysis framework
Stars: ✭ 116 (+176.19%)
Mutual labels:  malware-analysis, malware-research
Threat Hunting
Personal compilation of APT malware from whitepaper releases, documents and own research
Stars: ✭ 219 (+421.43%)
Mutual labels:  malware-analysis, malware-research
Xapkdetector
APK/DEX detector for Windows, Linux and MacOS.
Stars: ✭ 208 (+395.24%)
Mutual labels:  malware-analysis, malware-research
Malware-Zoo
Hashes of infamous malware
Stars: ✭ 18 (-57.14%)
Mutual labels:  malware-analysis, malware-research
Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..
Stars: ✭ 281 (+569.05%)
Mutual labels:  malware-analysis, malware-research
Mwdb Core
Malware repository component for samples & static configuration with REST API interface.
Stars: ✭ 125 (+197.62%)
Mutual labels:  malware-analysis, malware-research
Karton
Distributed malware processing framework based on Python, Redis and MinIO.
Stars: ✭ 134 (+219.05%)
Mutual labels:  malware-analysis, malware-research
Malwarelab vm Setup
Setup scripts for my Malware Analysis VMs
Stars: ✭ 126 (+200%)
Mutual labels:  malware-analysis, malware-research
Probedroid
A SDK for the creation of analysis tools without obtaining app source code in order to profile runtime performance, examine code coverage, and track high-risk behaviors of a given app on Android 5.0 and above.
Stars: ✭ 182 (+333.33%)
Mutual labels:  malware-analysis, malware-research
Fileintel
A modular Python application to pull intelligence about malicious files
Stars: ✭ 97 (+130.95%)
Mutual labels:  malware-analysis, malware-research
Awesome Yara
A curated list of awesome YARA rules, tools, and people.
Stars: ✭ 1,394 (+3219.05%)
Mutual labels:  malware-analysis, malware-research
Malwaresearch
A command line tool to find malwares on http://openmalware.org
Stars: ✭ 190 (+352.38%)
Mutual labels:  malware-analysis, malware-research
Drsemu
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
Stars: ✭ 237 (+464.29%)
Mutual labels:  malware-analysis, malware-research
View All Similar Projects ➔

BOnum NOMEN - good name

Hunt for Malware Critical Process Impersonation

How it works

The purpose of this tool is to detect process name impersonation using Damerau-Levenshtein algorithm. For example, a malware process could run under the name chr0me (note the 0 not o), thus observing that it's a possibly malicious process becomes harder.

To detect a process that tries to become stealth by process name impersonation, bonomen reads all the running processes on your system and compares their names with the processes(that you) provided in a file.

The processes you trust should be included in a file provided to bonomen at runtime with -f command line option, otherwise bonomen searches for the default file default_procs.txt. Every process should be written on a separate line, following the format:

process name;threshold;executable path

where:

process name - is the name of the process you trust, for example init

threshold - is the maximum distance between process names, for example between chrome and chr0me the distance is 1.

executable path - is the path to the executable of the process you trust, for example /sbin/init. This is used to check for processes that may be whitelisted.

Compile

In the root directory, for

  • release version, run:

cargo build --release

  • debug version, run:

cargo build

The compiled executable will be in target\{release|debug}\

Requirements

  • Unix OS (developed and tested on Debian GNU/Linux 8 64-bit).

  • Windows OS (developed and tested on Windows 10 64-bit).

  • Rust programming language version >= 1.13.0

  • File containing system critical processes using the following format:

    process name;threshold;process executable absolute path

    Example:

    init;1;/sbin/init
sshd;2;/usr/sbin/sshd

References & Acknowledgements

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].