|
| 1 | +# ProcFilter |
| 2 | + |
| 3 | +ProcFilter is a process filtering system for Windows with built-in YARA integration. YARA rules can be instrumented with custom meta tags that tailor its response to rule matches. It runs as a Windows service and is integrated with [Microsoft's ETW API](https://msdn.microsoft.com/en-us/library/windows/desktop/bb968803%28v=vs.85%29.aspx), making results viewable in Windows Event Log. Installation, activation, and removal can be done dynamically and do not require a reboot. |
| 4 | + |
| 5 | +ProcFilter's intended use is for malware analysts to be able to create YARA signatures that protect their environment against a specific threat. It does not include a large signature set. Think lightweight, precise, and targeted rather than broad or all-encompassing. ProcFilter is also intended for use in controlled analysis environments where custom plugins can perform artifact-specific actions. |
| 6 | + |
| 7 | +ProcFilter is compatible with Windows 7+ and Windows Server 2008+ systems. |
| 8 | + |
| 9 | +# Installers |
| 10 | +- [ProcFilter x86/x64 Release/Debug Installers](https://github.com/godaddy/procfilter/releases) |
| 11 | + |
| 12 | +# Features |
| 13 | ++ Deny processes based on YARA rules |
| 14 | ++ Highly configurable via INI-configurable |
| 15 | ++ Installation/removal without rebooting |
| 16 | ++ Built-in performance measuring and stress testing |
| 17 | ++ Plugins extend or augment ProcFilter's behavior |
| 18 | ++ Command-line behavior includes YARA scanning, file hashing, and service status querying |
| 19 | + |
| 20 | +# Configuration |
| 21 | +[procfilter.ini](https://github.com/godaddy/procfilter/blob/master/files/procfilter.ini) contains a variety of variety of configurables, including: |
| 22 | ++ File/memory scanning on process create/terminate |
| 23 | ++ File/memory scanning periodically |
| 24 | ++ File/Memory scanning on executable image load |
| 25 | + |
| 26 | +procfilter.ini also include a variety of plugin-specific options in addition. |
| 27 | + |
| 28 | +# Project Goals |
| 29 | + |
| 30 | ++ Allow analysts to hook in to process and thread kernel events |
| 31 | ++ Operationalize the growing body of knowledge found in YARA signatures in the Windows environment |
| 32 | +* Fill in the gap between detection of a threat and vendor response |
| 33 | ++ Be a lightweight, configurable, additional layer of defense |
| 34 | + |
| 35 | +# Project Non-Goals |
| 36 | + |
| 37 | ++ Become an A/V replacement |
| 38 | +* A/V does much more than ProcFilter: Behavior based detection, code emulation, centralized management, self-protection, inter-process communication and monitoring, examines file operations, examines network behavior, and many more vendor-specific features |
| 39 | + |
| 40 | +ProcFilter could do some or all of these things in the future through plugins but these features are currently out of scope as the project is being established. |
| 41 | + |
| 42 | +# Signatures |
| 43 | + |
| 44 | +Signatures can either come from disk or more conveniently from a Git repository. Configuration can specify a Git URL to pull updates from and the service will automatically check out and load new commits. |
| 45 | + |
| 46 | +By default ProcFilter will respond to 3 boolean meta tags within YARA rules: |
| 47 | + |
| 48 | +| Meta Tag | Action | |
| 49 | +| ---------- | ------ | |
| 50 | +| Block | Block the process associated with rule matches | |
| 51 | +| Log | Allow the process but log its presence | |
| 52 | +| Quarantine | Make a copy of the associated file in a quarantine location | |
| 53 | + |
| 54 | +ProcFilter comes with a small set of default rules to get analysts started. It *does not* contain a large rule set meant to catch everything. In fact, it only includes rules for very select few families. [View the default rule set here](https://github.com/godaddy/yara-rules). While it is possible to include a massive rule set, consider the potential for false-positives, difficulty in rule creation, and fundamental limitations of signature-based prevention -- all-encompassing rule sets quickly become a much more difficult challenge than it may appear at the outset. See the "Advocacy for Signature Sharing" section below for more details. |
| 55 | + |
| 56 | +Plugins can add handlers for custom meta tags. The 'cmdline' plugin, for example, looks for ```CaptureCommandLine``` tags that trigger it to record command line options associated with rule matches. |
| 57 | + |
| 58 | +# Jusitification and Effective Usage |
| 59 | + |
| 60 | +ProcFilter is **not** an AntiVirus replacement. ProcFilter contains a *minimal* signature set and will miss most malware by default. Despite this it still has high utility and is a valuable component of a defense-in-depth strategy against unwanted software. |
| 61 | + |
| 62 | +ProcFilter uses YARA and YARA is signature-based. This means that in order to block something it must have been seen before. Signature evasion is trivial -- repack and evade -- although it does raise the bar of difficulty for an attacker since it generally follows that that the more an attacker tries to hide a payload the more prominent and detectable the hiding mechanism becomes. |
| 63 | + |
| 64 | +Sophisticated payloads tend to be complex pieces of software and like any other complex software do not change drastically over time even though the packing might. Well-written signatures may work for longer periods of time, keying in on aspects of code unlikely to change across obfuscations, packing, or varied compilation options. Sometimes it's possible to "see through" packing as [in this example](https://github.com/godaddy/yara-rules/blob/master/emotet.yara). |
| 65 | + |
| 66 | +Post-execution memory scanning, while resource intensive, can detect post-execution payloads. It's not preventative but it will give you visibility and awareness you wouldn't have had otherwise. Furthermore, this can be used by analysts in a controlled environment to detect payloads of packed malware without having to involve a debugger. |
| 67 | + |
| 68 | +Legitimate software is not often packed and rules that detect packers can help identify unwanted software. You may not need to know what something is -- just that it's hiding its behavior is enough. For example, you may know that packed software should not be run in a specific, tightly-controlled environment, making ProcFilter an effective mitigation or additional indicator of unwanted behavior. Note that this is environment dependent; some legitimate software such as games use packers like UPX to compress game assets and minimize executable size. |
| 69 | + |
| 70 | +### Signature Sharing |
| 71 | + |
| 72 | +Signature sharing is a challenge. If signatures are publicly visible then an attacker can test against them until evasion is successful. Addtionally, the open format of YARA provides a roadmap to exactly what within a family is causing the detection. On the other hand, this consumes the attacker's resources by forcing them to adapt. Additionally, prior releases of the malware will no longer be effective once a signature has been created. |
| 73 | + |
| 74 | +Considering the pros and cons, it's advisable to avoid subscribing to the belief of keeping security-related information private to avoid “tipping the hand to attackers”. The benefit of open information exchange is multiplicative and with that comes the ability to out scale — consider the success of software such as AdBlock. If you have a community of people with the same vested interest in solving the next new problem you’re a lot better off than if you kept your tips & tricks private and remained independent in the fight against malware. |
| 75 | + |
| 76 | +Furthermore, consider that if signature evasion is a problem, custom-written plugins still have plenty of opportunity to perform advanced actions to detect malware. ProcFilter can be extended in many different dimensions to meet a multitude of techniques. |
| 77 | + |
| 78 | +Pros of Sharing: |
| 79 | ++ Promotes a community in which resources can be pooled |
| 80 | ++ Remains effective against prior releases/deployments of a malware family |
| 81 | ++ Reduces duplicated effort which is currently the status quo |
| 82 | ++ Once a threat is identified, signatures can be shared across all participants |
| 83 | ++ The larger the community defining the threats, the less damage they will be able to do |
| 84 | + |
| 85 | +Cons of Sharing: |
| 86 | ++ Attackers can test against public signatures until evasion is successful |
| 87 | ++ The open format of YARA provides information as to what exactly needs to be changed to evade signatures |
| 88 | + |
| 89 | +Sharing in a semi-open fashion between trusted partners via private forums can be an effective way to mitigate the cons of open sharing. |
| 90 | + |
| 91 | +# API |
| 92 | +ProcFilter exposes a C API that can extend or alter behavior. For example, a plugin could perform custom actions based on tags in YARA signature's meta sections [cmdline plugin](https://github.com/godaddy/procfilter/blob/master/launchcmd/launchcmd.cpp). The C API header file [is located here](https://github.com/godaddy/procfilter/blob/master/service/include/procfilter/procfilter.h). |
| 93 | + |
| 94 | +Event list (See [procfilter.h](https://github.com/godaddy/procfilter/blob/master/service/include/procfilter/procfilter.h) for the full list): |
| 95 | ++ Process Creation/Termination |
| 96 | ++ Thread Creation/Termination |
| 97 | ++ Executable Image Load |
| 98 | ++ Scan start/finish |
| 99 | + |
| 100 | +Example plugins: |
| 101 | ++ [SHA1 Whitelisting](https://github.com/godaddy/procfilter/blob/master/sha1/sha1.cpp) - Whitelist/blacklist files based on SHA1 hash |
| 102 | ++ [Command Line Capturing](https://github.com/godaddy/procfilter/blob/master/cmdline/cmdline.cpp) - Record command line parameters passed to programs that match rules |
| 103 | ++ [Interactive](https://github.com/godaddy/procfilter/blob/master/interactive/interactive.cpp) - Interactively allow/deny processes as they are created |
| 104 | ++ [Unpack](https://github.com/godaddy/procfilter/blob/master/unpack/unpack.cpp) - Capture a post-execution process snapshot when a process ends |
| 105 | ++ [Launch Command](https://github.com/godaddy/procfilter/blob/master/launchcmd/launchcmd.cpp) - Execute a command when a rule match occurs |
| 106 | ++ [Filenames](https://github.com/godaddy/procfilter/tree/master/filenames/filenames.cpp) - Block processes based on filename |
| 107 | ++ [Remote Thread Denial](https://github.com/godaddy/procfilter/blob/master/remotethread/remotethread.cpp) - Interactively allow/deny remote thread creation |
| 108 | + |
| 109 | +# Risks |
| 110 | + |
| 111 | +Running ProcFilter introduces attack surface just as any additional software does. While it has been written with security in mind it may have vulnerabilities or the libraries it depends on may have vulnerabilities -- this is no different than any other software. It may be susceptible to system crashes, errant behavior, or security vulnerabilities. Just because this is a security tool does not make it suddenly immune to the pitfalls and caveats of modern programming languages. The hope is that the tradeoff of risks prevented versus risks introduced is favorable. |
| 112 | + |
| 113 | +ProcFilter is beta and is not quite yet ready for use in production environments. |
| 114 | + |
| 115 | +# Example Use Cases |
| 116 | + |
| 117 | +### Use Case #1 |
| 118 | + |
| 119 | +Analysts at a peer organization detected or were hit by a spear phishing attack. They share their YARA signature with you for use in ProcFilter, minimizing the chance your organization will be hit by the same sample, or if the signature is good, other samples within that family. |
| 120 | + |
| 121 | +### Use Case #2 |
| 122 | + |
| 123 | +US-CERT releases a report containing a YARA signature for a malware family, [https://www.us-cert.gov/ncas/alerts/TA14-353A](such as in this 2014 report). You incorporate their YARA signatures into your rule set to minimize the chance your organization will be hit by a variant of the same. |
| 124 | + |
| 125 | +### Use Case #3 |
| 126 | + |
| 127 | +A specific threat actor is known to upload copies of command shells within a shared access environment. The differing filename or path prevents you from capturing this activity. In order to detect and analyze this actor's behavior, ProcFilter is run with a signature for the [Windows command shell](https://github.com/godaddy/yara-rules/blob/master/features/command_shell.yara), the [Command Line Capturing](https://github.com/godaddy/procfilter/blob/master/cmdline/cmdline.cpp) plugin enabled, and the ```CaptureCommandLine``` value in the meta section set to true. |
| 128 | + |
| 129 | +When the attacker uploads and runs a command shell that matches the signature the command line arguments are recorded to Event Log. |
| 130 | + |
| 131 | +### Use Case #4 |
| 132 | + |
| 133 | +The same TA packs the command shell with UPX so it's no longer detected by file scanning at process launch. ProcFilter's post-execution memory scanning is enabled which matches the command shell signature, consequently capturing the command line at process termination. |
| 134 | + |
| 135 | +### Use Case #5 |
| 136 | + |
| 137 | +A malware analyst needs to get a memory snapshot of a packed sample but running it in a controlled debug environment fails because the sample detects the environment and crashes out or exists before it is unpacked in memory. The malware analyst enables the 'unpack' ProcFilter plugin, which successfully takes a memory snapshot at process termination since ProcFilter does act as a debugger. Note that this is a cat and mouse game since ProcFilter is detectable from userland and could be detected by an unpacking stub. |
| 138 | + |
| 139 | +### Use Case #6 |
| 140 | + |
| 141 | +A malware analyst wants to know if a packed sample is related to a sample found before. Scans against the file turn up nothing due to the packing. The analyst runs the sample in a controlled environment containing ProcFilter with post-execution memory scanning enabled. At program termination the address space is scanned which matches rules in the set, indicating the type of payload. |
| 142 | + |
| 143 | +# License |
| 144 | + |
| 145 | +ProcFilter is licensed under the MIT license [located here](https://github.com/godaddy/procfilter/blob/master/LICENSE.md). |
0 commit comments