“I understand it now.”: Adaptive Rule-Based Security

Building an semi-automated malware pipeline that parses and generates adaptive rules for raw PE, ELF and Mac-Oh malware.

Rule based security, a concept where an enforcing/ monitoring software implements given security measures based of a given rule set usually consisting of common behavioural patterns of malware or malicious activity.

Now while that is a solid security approach, it has a few gaps.

What happens when this approach is met with a zero-day or deviant malware or really just any malware whose behavioural pattern is not known or is not covered by the rules set?

That’s why I built malregistry.

Malregistry is a semi-automated malware analysis pipeline that takes a raw PE/ELF/Mach-O sample, performs static/dynamic analysis in a sandbox, extracts indicators (strings, API calls, network signatures, YARA matches), and auto-generates Suricata IDS rules and Sigma detection rules from the findings. Then validate the rules against a clean traffic/dataset corpus to confirm no false positives.

Here’s that again in english: It’s a tool that allows the user to test malicious windows, linux and Mac OS executables or suspected malware in a safe controlled environment by either directly interacting with it or just viewing from the surface, understanding its behavioural patterns and automatically creating rules against it.

There are five cores that make up malregistry. Each core powers a functionality that keeps your system safe.

• **Static Analysis Core: *An analysis engine that parses PE/ELF headers, extracts imports and exports sections, embedded strings before following up with compiling timestamps and conducting an entropy analysis and packer detection. This core utilises pefile, lief and capstone for disassembly and is paired with yara-python* for packer sigs.
• **Dynamic Analysis Core: **This core actively analyses the sample by directly executing it, allowing it to hook API calls, capture network traffic and dump process memory. It uses speakeasy as a windows emulator allowing for the analysis of windows executables in other environments and frida/Qiling for ELF and Mac-Oh samples.

Do not execute malware samples on your computer. Only run dynamic analysis in a controlled environment like a local VM or Docker.

• *IOC Extraction Core: *It pulls IPs, Domain URLs, registry keys, mutex names, file paths and C2 patterns. Pretty much any identifier particular to the sample. It mixes a bit of regex, custom heuristics and flare-floss (for obsfuscated strings)
• **Rule Generation Core: **Here’s where everything comes together. Based off the identifiers gathered by the IOC core, it programmatically writes Suricata rules (with proper content, flow and sid numbering) and Sigma rules (with log source, detection and false postive fields).
• **Validation Core: **One last final check before everything gets locked in. it runs generated rules against a clean PCAP + public malware PCAP corpus (like Malware-Traffic-Analysis.net) and reports true/false positive rates.

Okay, that’s enough talk. Let’s walk-through setting up/ using malregistry. It’s why you’re here anyway.

1. Get the repository: Download the zip here or clone repo in terminal:

git clone https://github.com/cosmicsuami/malregistry.git

2. Setting Up:

• Activate Environment: Activate environment to isolate python environment. This serves to prevent version install conflicts and protects external packages from breakages and crashes.

python3 -m venv venv
source venv/bin/activate

• Install dependencies: as listed in the requirements.txt file.

pip install -r requirements.txt

• Organising Samples: While samples can be pointed at from any directory on your machines, it’s advisable to store all samples in the /samples directory for organisation and tracking purposes.

3. Usage + Modes and Flags:

• Running a default analysis: When looking to perform a complete analysis of a given sample, the recommended approach is a default analysis. A default analysis covers static analysis, dynamic analysis (using speakeasy), IOC extraction, rule creation and validation.

To run default analysis, simply run the tool while pointing to the sample.

python malregistry.py samples/Malware.exe

A comprehensive tabular summary is displayed at the end of each analysis with a detailed report generated at /reports as a .json file.

• Rule creation: After the analysis the file path to both Suricata and Sigma would be displayed, allowing the user to navigate to and view. Rules generally created in the rules/generated/ directory as .rules and .yml files respectively.
• Dynamic Analysis: The tool utilizes three dynamic analysis methods, each covering a given scope. Speakeasy, Frida and Dotnet dynamic analysis methods.

speakeasy method: For portable executable emulation based dynamic analysis. This is the method used in default analysis.

frida: Used for runtime analysis. It aggressively executes and interacts with the malware on the host machine. Frida analysis is time intensive so for efficiency reasons it timeouts after 60 seconds, printing a command to run the frida analysis separately (outside malregistry) and skipping to the next step.

dotnet: Used for static .NET/CIL metadata analysis.

Qiling: Used when handling ELF and Mac-Oh samples. If a sample is identified as ELF/Mach-Oh, dynamic analysis would automatically be routed to this option.

• Flags:

default analysis: python malregistry.py [path/to/sample/]
static analysis: --static-only
dynamic analysis: --dynamic-method [method]
                                    speakeasy
                                    frida
                                    dotnet

all flags + details can be displayed using the --man, -h or --help flag. 

You’re all set. Have fun.

Disclaimer: Do not run dynamic analysis on your host machine (yes, read that again) and do not download malware samples on your host machine.

Incase you missed link, download/clone the repo here: https://github.com/cosmicsuami/malregistry

Follow my LinkedIn: https://www.linkedin.com/in/monday-suami-a84959255/

Shoot me a mail: mondaysuami@gmail.com

Thank you, goodnight.