binsnitch - Detect silent (unwanted) changes to files on your

项目说明

binsnitch.py

binsnitch can be used to detect silent unwanted changes to files on your system.
It will scan a gi recursively for files and keep track of any changes it detects, based on the SHA256 hash of the file.
You have the option to either track executable files, or all files.

Requirements

python >= 3

Running and usage

Example: monitor all executable files on the system and enable logging

Example: monitor all files in the current directory and enable logging

How it works

Once `binsnitch.py is running, it will scan all files in dir (provided through a required command line argument) recursively, and create a SHA256 hash of each file it finds. It then does the following:


If a file is not known yet by binsnitch.py, its details will be added to binsnitch_data/db.json (file name, file type and hash).




If a file is already known but the calculated hash is different from the one in binsnitch_data/db.json, an alert will be logged to data/alert.log. In addition, the new hash will be added to the appropriate entry in binsnitch_data/db.json.




If a file is already known and the hash is identical to the one already in binsnitch_data/alert.log, nothing happens.

Example output

##### binsnitch_data/alerts.log

##### binsnitch_data/db.json

Internals


Checking if a file is executable is done by checking it against a fixed list of dangerous file extensions (check binsnitch.py source for details).

In its current , binsnitch.py eats up a lot of CPU. This is caused by the recursive walk through the filesystem and the calculation of SHA256 hashes for each and every file it encounters.

Ideas for impro

~~Include a switch to start with a new alerts and db file upon start~~ ☑

~~Include a switch to also process new files~~ ☑

~~Enable a switch to process all files instead of executables only~~ ☑

~~Include a switch for a single pass instead of running forever~~ ☑

~~Remo on file command to check for file type information~~ ☑

Be nicer to system resources (IO and CPU)

Why binsnitch?

Malware will often settle itself by o existing executable applications in order to avoid detection.
Recent malware cases (May 2017) do this, including HandBrake being hacked to drop new of the Proton malware and the WannaCry ransomware o C:\WINDOWS\system32\tasksche.exe.
This triggered us to write a simple tool that could be used to detect this.

binsnitch can also be used during malware analysis, to detect silent changes to files (i.e. replacement of a trusted Windows executable by a trojaned ).

References and comparison to other tools

Similar tools:


Tripwire Open Source -

Microsoft File Checksum Integrity -

Syscheck in OSSEC -

These tools are either OS-dependent or require installation of libraries. In addition, binsnitch.py can be used to detect changes to the file system after an infection has taken place (not depending on intercepting API calls during the infection itself) - for example, when analyzing a disk image against a "known good" baseline.

binsnitch.py has no dependencies other than python >= 3`.

Community

Bug reports and feature requests are welcome in the issues tab!

Contact us: .

binsnitch is de and maintained by Daan Raman ().

项目信息

开发语言：Python

Star 数：162

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Detect silent (unwanted) changes to files on your system展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。