attack_monitor - Endpoint detection & Malware analysis software

项目说明

Attack Monitor

Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 (and all later ) workstations/servers and to automate dynamic analysis of malware.

Current modes (mutually exclusive):
- Endpoint detection (ED)
- Malware analysis (on dedicated Machine)

Based on events from:
- Windows event logs
- Sysmon
- Watchdog (Filesystem monitoring Python library)
- TShark (only malware analysis mode)

Current

0.9.0 (Alpha)

Contact

Demo

!demo/ed.gif

Supported OS

* Windows 7, 8, 10 (x86 or x64)
* Windows 2008, 2012, 2016 (x86 or x64)

Pre-requirements

Powershell 5

Sysmon (Downloaded, configured and installed by installer.py)

Python 3.6 (64-bit) - should work on Python 3.x

Tshark (Malware analysis only)

Python3 libraries (requirements.txt)

StoneEngine library (included, first time published, high le event log interface - Alpha state)

Supported system events

> Some of the events are only supported in Malware Analysis Mode

Filesystem changes

Permitted network connections

PowerShell activity (detailed only with PowerShell 5)

Process creation

SMB activity

Scheduled tasks

Local accounts manipulations

Success/Failed logins

Drivers load

Raw disk access

Registry monitoring

Pipe events

Services

Audit log cleared

WMI monitoring of queries + WMI persistence

DNS requests capture ()

Installation - Endpoint Detection Mode

> For Malware analysis mode - refer to next section

Installation - Malware analysis Mode

> For Endpoint detection mode - refer to previous section

Installation - How to enable WMI audit?

Why it's not in installer<span></span>.py script? It's hard to do it programmatically

Installation - How to choose network interface for malware listening?

Edit *C:\Program Files\Attack Monitor\config\attack_monitor.cfg*

Change in section [feeder_network_tshark]:
network_interface=PUT INTERFACE NAME HERE # without quotes

#### How to determine inteface name?
TShark is using name from Control Panel\Network and Internet\Network Connections (Change adapter settings)
e.g. name: WiFi AC => Custom name defined by user
e.g. name: Ethernet0

Installation - How to monitor specific directories?

Edit *C:\Program Files\Attack Monitor\config\monitored_directories.json*

For malware analysis it's recommended to monitor all events (except dir_modified) for directory C:\ with recursive flag enabled. Please add also additional directories if relevant.

How it works?

1. Alert is coming from source (Windows Event Log, Sysmon, Filesystem change, TShark)
2. Alert is checked against *config\exceptions\exception.json* which contains all alerts which should be ignored
A) For Endpoint Detection - Predefined set of ignored alerts is delivered with software
B) For Malware analysis - you need to add exceptions yourself on li in clean state
3. Alert is present in *exception.json*?
Yes) Is discared [Go to step 1]
No) Go to next step
4. Is learning mode enabled? *(Can be enabled in tray icon, or permanently in configuration file)*
Yes) Alert window popup asking you if you want to ignore this alert, if yes which fields must match to consider event as ignored? (simple comparision, substring, regex)

- If you decided to add exception for this alert - Alert is added to exceptions [Go to step 1]
- If you decided to skip exception window - Go to next step

No) Go to next step
5. Alert user about capture event. Outputs:
- System tray baloon notification (Only when you are moving mouse and computer isn't locked)
- Alert is saved to *logs\\<YYYY-MM-DD>.txt*

Known bugs

Exit isn't gracefull

Tray icon appears and disappears

项目信息

开发语言：Python

Star 数：233

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Endpoint detection & Malware analysis software展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。