Skip to content
This repository has been archived by the owner on Nov 10, 2022. It is now read-only.
/ bonomen Public archive

BONOMEN - Hunt for Malware Critical Process Impersonation

License

Notifications You must be signed in to change notification settings

0xcpu/bonomen

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

34 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

BOnum NOMEN - good name

Hunt for Malware Critical Process Impersonation

How it works

The purpose of this tool is to detect process name impersonation using Damerau-Levenshtein algorithm. For example, a malware process could run under the name chr0me (note the 0 not o), thus observing that it's a possibly malicious process becomes harder.

To detect a process that tries to become stealth by process name impersonation, bonomen reads all the running processes on your system and compares their names with the processes(that you) provided in a file.

The processes you trust should be included in a file provided to bonomen at runtime with -f command line option, otherwise bonomen searches for the default file default_procs.txt. Every process should be written on a separate line, following the format:

process name;threshold;executable path

where:

process name - is the name of the process you trust, for example init

threshold - is the maximum distance between process names, for example between chrome and chr0me the distance is 1.

executable path - is the path to the executable of the process you trust, for example /sbin/init. This is used to check for processes that may be whitelisted.

Compile

In the root directory, for

  • release version, run:

cargo build --release

  • debug version, run:

cargo build

The compiled executable will be in target\{release|debug}\

Requirements

  • Unix OS (developed and tested on Debian GNU/Linux 8 64-bit).

  • Windows OS (developed and tested on Windows 10 64-bit).

  • Rust programming language version >= 1.13.0

  • File containing system critical processes using the following format:

    process name;threshold;process executable absolute path
    

    Example:

    init;1;/sbin/init
    sshd;2;/usr/sbin/sshd
    

References & Acknowledgements

About

BONOMEN - Hunt for Malware Critical Process Impersonation

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages