Hunting for Abnormalities

Uses some awesome existing repositories:

• https://github.com/chenerlich/FCL
• https://Neo23x0/signature-base
• https://github.com/yaml/pyyaml

• Abnormally Short-Named Binaries [DONE]
• Potentially Dangerous Extension [DONE]
• Binaries in User Locations
• Recently Added

• Abnormally Short-Named Binaries [DONE]
• Starting from User Directory [DONE]

• RunOnce/RunServices/Run etc
• Extension Hijacking
• Debug
• ShimDB
• Program Associations

• Checking certain paths for known-dangerous redteam/malware file names [DONE]

• Checking certain paths for known-dangerous extensions [DONE]

• Recursively check certain paths for file names with a trailing space which may be an obfuscation technique [DONE]
• Check certain files and compare current extension with known magic byte identifier

• Checking for known-dangerous redteam/malware names file Names [DONE]

• Checking Active TCP Connections for suspicious properties (SMB, RDP, TelNet, SSH, WinRM) [DONE]
• Checking qwinsta/quser/qprocess for Suspicious Active Connections

• Suspicious Recently Opened Files
• Suspicious File Execution Artifacts
• Files Executed with 'Run'
• Internet Access to Suspicious TLDs
• Suspicious Typed Paths for Windows
• Recently Opened Office Documents with Suspicious Extension

• Check for suspicious TLDs
• Check for recently downloaded suspicious file-types

• YARA Scan suspicious file extensions
• YARA Scan suspicious / active processes

• Scanning dangerous extension types across certain paths for known malicious hashes [LOGIC DONE]
  • Done using Loki Signature Base currently, updated at runtime.
• TODO: Find additional high-fidelity datasets for integration.

• Check active network connections for known C2/Evil

• Checking for dangerous commands/modules in history files [LOGIC DONE]

• Checking for dangerous commands/module presence

• Checking for Users Added to the System
• Checking for localgroup Modifications, Administrator Adds, etc
• Checking for brute-force style activity
• Checking for historical network logons
• Checking for dangerous command-line usage [LOGIC DONE]

• YARA scan active processes with relevant rules
• Check command-line for potential evil
• Check process path and other statistics for known bad patterns

• Check existing CIM providers for any potential tampering