forked from cuckoosandbox/cuckoo
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathbehavior.py
More file actions
339 lines (275 loc) · 11.2 KB
/
Copy pathbehavior.py
File metadata and controls
339 lines (275 loc) · 11.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
# Copyright (C) 2010-2015 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
import collections
import logging
import os
from lib.cuckoo.common.abstracts import Processing, BehaviorHandler
from lib.cuckoo.common.config import Config
from .platform.windows import WindowsMonitor
from .platform.linux import LinuxSystemTap
log = logging.getLogger(__name__)
class Summary(BehaviorHandler):
"""Generates overview summary information (not split by process)."""
key = "summary"
event_types = ["generic"]
def __init__(self, *args, **kwargs):
super(Summary, self).__init__(*args, **kwargs)
self.results = collections.defaultdict(set)
def handle_event(self, event):
self.results[event["category"]].add(event["value"])
def run(self):
for key, value in self.results.items():
self.results[key] = list(value)
return self.results
class Anomaly(BehaviorHandler):
"""Anomaly detected during analysis.
For example: a malware tried to remove Cuckoo's hooks.
"""
key = "anomaly"
event_types = ["anomaly"]
def __init__(self, *args, **kwargs):
super(Anomaly, self).__init__(*args, **kwargs)
self.anomalies = []
def handle_event(self, call):
"""Process API calls.
@param call: API call object
@param process: process object
"""
category, funcname, message = None, None, None
for row in call["arguments"]:
if row["name"] == "Subcategory":
category = row["value"]
if row["name"] == "FunctionName":
funcname = row["value"]
if row["name"] == "Message":
message = row["value"]
self.anomalies.append(dict(
# name=process["process_name"],
# pid=process["process_id"],
category=category,
funcname=funcname,
message=message,
))
def run(self):
"""Fetch all anomalies."""
return self.anomalies
class ProcessTree(BehaviorHandler):
"""Generates process tree."""
key = "processtree"
event_types = ["process"]
def __init__(self, *args, **kwargs):
super(ProcessTree, self).__init__(*args, **kwargs)
self.processes = {}
def handle_event(self, process):
if process["pid"] in self.processes:
log.warning("Found the same process identifier twice, this "
"shouldn't happen!")
return
self.processes[process["pid"]] = {
"pid": process["pid"],
"ppid": process["ppid"],
"process_name": process["process_name"],
"command_line": process.get("command_line"),
"first_seen": process["first_seen"],
"children": [],
"track": process["track"],
}
def run(self):
root = {"children": []}
for p in self.processes.values():
self.processes.get(p["ppid"], root)["children"].append(p)
return root["children"]
class GenericBehavior(BehaviorHandler):
"""Generates summary information."""
key = "generic"
event_types = ["process", "generic"]
def __init__(self, *args, **kwargs):
super(GenericBehavior, self).__init__(*args, **kwargs)
self.processes = {}
def handle_process_event(self, process):
if process["pid"] in self.processes:
return
self.processes[process["pid"]] = {
"pid": process["pid"],
"pid": process["ppid"],
"process_name": process["process_name"],
"first_seen": process["first_seen"],
"summary": collections.defaultdict(set),
}
def handle_generic_event(self, event):
if event["pid"] in self.processes:
# TODO: rewrite / generalize / more flexible
pid, category = event["pid"], event["category"]
self.processes[pid]["summary"][category].add(event["value"])
else:
log.warning("Generic event for unknown process id %u", event["pid"])
def run(self):
for process in self.processes.values():
for key, value in process["summary"].items():
process["summary"][key] = list(value)
return self.processes.values()
class ApiStats(BehaviorHandler):
"""Counts API calls."""
key = "apistats"
event_types = ["apicall"]
def __init__(self, *args, **kwargs):
super(ApiStats, self).__init__(*args, **kwargs)
self.processes = collections.defaultdict(lambda: collections.defaultdict(lambda: 0))
def handle_event(self, event):
self.processes["%d" % event["pid"]][event["api"]] += 1
def run(self):
return self.processes
class PlatformInfo(BehaviorHandler):
"""Provides information about the platform for the collected behavior.
Not sure if this is really needed, as probably all the info is in the results["info"] area.
"""
key = "platform"
# self.results = {
# "name": "windows",
# "architecture": "unknown", # look this up in the task / vm info?
# "source": ["monitor", "windows"],
# }
class BehaviorAnalysis(Processing):
"""Behavior Analyzer.
The behavior key in the results dict will contain both default content keys
that contain generic / abstracted analysis info, available on any platform,
as well as platform / analyzer specific output.
Typically the analyzer behavior contains some sort of "process" separation as
we're tracking different processes in most cases.
So this looks roughly like this:
"behavior": {
"generic": {
"processes": [
{
"pid": x,
"ppid": y,
"calls": [
{
"function": "foo",
"arguments": {
"a": 1,
"b": 2,
},
},
...
]
},
...
]
}
"summary": {
"
}
"platform": {
"name": "windows",
"architecture": "x86",
"source": ["monitor", "windows"],
...
}
}
There are several handlers that produce the respective keys / subkeys. Overall
the platform / analyzer specific ones parse / process the captured data and yield
both their own output, but also a standard structure that is then captured by the
"generic" handlers so they can generate the standard result structures.
The resulting structure contains some iterator onions for the monitored function calls
that stream the content when some sink (reporting, signatures) needs it, thereby
reducing memory footprint.
So hopefully in the end each analysis should be fine with 2 passes over the results,
once during processing (creating the generic output, summaries, etc) and once
during reporting (well once for each report type if multiple are enabled).
"""
key = "behavior"
def _enum_logs(self):
"""Enumerate all behavior logs."""
if not os.path.exists(self.logs_path):
log.warning("Analysis results folder does not exist at path %r.", self.logs_path)
return
logs = os.listdir(self.logs_path)
if not logs:
log.warning("Analysis results folder does not contain any behavior log files.")
return
for fname in logs:
path = os.path.join(self.logs_path, fname)
if not os.path.isfile(path):
log.warning("Behavior log file %r is not a file.", fname)
continue
analysis_size_limit = self.cfg.processing.analysis_size_limit
if analysis_size_limit and \
os.stat(path).st_size > analysis_size_limit:
# This needs to be a big alert.
log.critical("Behavior log file %r is too big, skipped.", fname)
continue
yield path
def run(self):
"""Run analysis.
@return: results dict.
"""
self.cfg = Config()
self.state = {}
# these handlers will be present for any analysis, regardless of platform/format
handlers = [
GenericBehavior(self),
ProcessTree(self),
Summary(self),
Anomaly(self),
ApiStats(self),
# platform specific stuff
WindowsMonitor(self),
LinuxSystemTap(self),
]
# doesn't really work if there's no task, let's rely on the file name for now
# # certain handlers only makes sense for a specific platform
# # this allows us to use the same filenames/formats without confusion
# if self.task.machine.platform == "windows":
# handlers += [
# WindowsMonitor(self),
# ]
# elif self.task.machine.platform == "linux":
# handlers += [
# LinuxSystemTap(self),
# ]
# create a lookup map
interest_map = {}
for h in handlers:
for event_type in h.event_types:
if event_type not in interest_map:
interest_map[event_type] = []
# If available go for the specific event type handler rather
# than the generic handle_event.
if hasattr(h, "handle_%s_event" % event_type):
fn = getattr(h, "handle_%s_event" % event_type)
interest_map[event_type].append(fn)
elif h.handle_event not in interest_map[event_type]:
interest_map[event_type].append(h.handle_event)
# Each log file should be parsed by one of the handlers. This handler
# then yields every event in it which are forwarded to the various
# behavior/analysis/etc handlers.
for path in self._enum_logs():
for handler in handlers:
# ... whether it is responsible
if not handler.handles_path(path):
continue
# ... and then let it parse the file
for event in handler.parse(path):
# pass down the parsed message to interested handlers
for hhandler in interest_map.get(event["type"], []):
res = hhandler(event)
# We support one layer of "generating" new events,
# which we'll pass on again (in case the handler
# returns some).
if not res:
continue
for subevent in res:
for hhandler2 in interest_map.get(subevent["type"], []):
hhandler2(subevent)
behavior = {}
for handler in handlers:
try:
r = handler.run()
if not r:
continue
behavior[handler.key] = r
except:
log.exception("Failed to run partial behavior class \"%s\"", handler.key)
return behavior