Attack Monitor is Python application written to enhance security monitoring capabilities of Windows 7/2008 (and all later versions) workstations/servers and to automate dynamic analysis of malware.
Current modes (mutually exclusive):
- Endpoint detection (ED)
- Malware analysis (on dedicated Virtual Machine)
Based on events from:
- Windows event logs
- Watchdog (Filesystem monitoring Python library)
- TShark (only malware analysis mode)
attack. monitor. github @gmail. com
- Windows 7, 8, 10 (x86 or x64)
- Windows 2008, 2012, 2016 (x86 or x64)
- Powershell 5
- Sysmon (Downloaded, configured and installed by installer.py)
- Python 3.6 (64-bit) – should work on Python 3.x
- Tshark (Malware analysis only)
- Various Python3 libraries (requirements.txt)
- StoneEngine library (included, first time published, high level windows event log interface – Alpha state)
Supported system events
Some of the events are only supported in Malware Analysis Mode
- Filesystem changes
- Permitted network connections
- PowerShell activity (detailed only with PowerShell 5)
- Process creation
- SMB activity
- Scheduled tasks
- Local accounts manipulations
- Success/Failed logins
- Drivers load
- Raw disk access
- Registry monitoring
- Pipe events
- Audit log cleared
- WMI monitoring of queries + WMI persistence
- DNS requests capture (via Tshark)
Installation – Endpoint Detection Mode
For Malware analysis mode – refer to next section
STEPS: cmd.exe (Run as admin) pip3 install -U -r requirements.txt python installer.py sysmon => Choose endpoint detection mode python installer.py psaudit python installer.py auditpol python installer.py install => Choose endpoint detection mode python installer.py exceptions [Apply section] Installation - How to enable WMI audit?
Installation – Malware analysis Mode
For Endpoint detection mode – refer to previous section:
STEPS: cmd.exe (Run as admin) pip3 install -U -r requirements.txt python installer.py sysmon => Choose malware analysis mode python installer.py psaudit python installer.py auditpol python installer.py install => Choose malware analysis mode [Install tshark] https://www.wireshark.org/download.html // To default location [Apply section] Installation - How to choose network interface for malware listening? // (currently only DNS) [Apply section] Installation - How to enable WMI audit? [Apply section] Installation - How to monitor specific directories?
Installation – How to enable WMI audit?
compmgmt.msc Services and Applications -> WMI Control -> Properties Security -> Security -> Advanced -> Auditing -> Add Select principal: Everyone Type: All Show advanced permissions: Select all (Execute Methods ... Edit Security)
Why it’s not in installer.py script? It’s hard to do it programmatically.
Installation – How to choose network interface for malware listening?
Edit C:\Program Files\Attack Monitor\config\attack_monitor.cfg
Change in section [feeder_network_tshark]: network_interface=PUT INTERFACE NAME HERE # without quotes
How to determine inteface name?
TShark is using name from Control Panel\Network and Internet\Network Connections (Change adapter settings) e.g. name: WiFi AC => Custom name defined by user e.g. name: Ethernet0
Installation – How to monitor specific directories?
Edit C:\Program Files\Attack Monitor\config\monitored_directories.json
For malware analysis it’s recommended to monitor all events (except dir_modified) for directory C:\ with recursive flag enabled. Please add also additional directories if relevant.
How it works?
- Alert is coming from source (Windows Event Log, Sysmon, Filesystem change, TShark)
- Alert is checked against config\exceptions\exception.json which contains all alerts which should be ignored A) For Endpoint Detection – Predefined set of ignored alerts is delivered with software B) For Malware analysis – you need to add exceptions yourself on live system in clean state
- Alert is present in exception.json? Yes) Is discared [Go to step 1] No) Go to next step
- Is learning mode enabled? (Can be enabled in tray icon, or permanently in configuration file) Yes) Alert window popup asking you if you want to ignore this alert, if yes which fields must match to consider event as ignored? (simple comparision, substring, regex)
- If you decided to add exception for this alert – Alert is added to exceptions [Go to step 1]
- If you decided to skip exception window – Go to next step
- Alert user about capture event. Outputs:
- System tray baloon notification (Only when you are moving mouse and computer isn’t locked)
- Alert is saved to logs\.txt
- Exit isn’t gracefull
- Tray icon appears and disappears