CPR evasion encyclopedia: The Check Point evasion repository
February 27, 2020
As malicious threats evolve, the necessity in automated solutions to analyze such threats emerges. It’s a very common case when malware samples are executed in some kind of virtualized environment.
These environments differ from usual host systems by a huge amount of artifacts: non-common files, registry keys, system objects, etc. By examining such artifacts malware samples are able to say if they are run in a virtualized environment.
Depending on the answer to this question, malware will continue its usual execution thus giving the researchers an opportunity to monitor its behavior – or will behave itself in an unexpected way and reveal nothing about its behavior.
If the latter was the case, we say that malware has successfully applied evasion technique, or simply evasion.
In this encyclopedia we have attempted to gather all the known ways to detect virtualized environment grouping them into big categories. Some categories are inactive on main page: it means that content will be added later. If it isn’t stated explicitly which operating system is described, Windows is meant by default.
Within each category the reader will find the following information:
- Description of the technique
- Code sample showing its usage
- Signature recommendations to track attempts to apply this technique
- Table with breakdown of which particular environments are detected with the help of certain constants
- Possible countermeasures
A lot of solutions with implemented techniques exist in open-source community. These solutions are used throughout the encyclopedia in the form of code excerpts from them. We are giving credits to open-source projects from where code samples were taken:
It’s important to add that Check Point researchers have produced their own open-source tool called InviZzzible.
If you want to contribute to this encyclopedia, you’re more than welcome to create pull requests in its github.
Please do check out all the repositories, browse through evasions encyclopedia and enjoy the journey!
Go to the evasion encyclopedia
POPULAR POSTS
- Artificial Intelligence
- ChatGPT
- Check Point Research Publications
- Check Point Research Publications
- Threat Research
- Artificial Intelligence
- ChatGPT
- Check Point Research Publications
BLOGS AND PUBLICATIONS
- Check Point Research Publications
- Global Cyber Attack Reports
- Threat Research
February 17, 2020
“The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign
- Check Point Research Publications
August 11, 2017
“The Next WannaCry” Vulnerability is Here
- Check Point Research Publications
January 11, 2018