dynmx（读作 dynamics）是一种基于签名的检测方法，用于基于Windows API调用序列的行为恶意软件特征。简而言之，你可以将dynmx视为用于API调用跟踪（所谓的函数日志）的YARA，这些跟踪来自恶意软件沙箱。因此，检测方法的数据基础不是静态分析的恶意软件样本本身，而是在恶意软件沙箱中对恶意软件样本进行动态分析期间生成的数据。目前，dynmx支持以下恶意软件沙箱的函数日志：
report.json文件）report.json文件）该检测方法在硕士论文《基于Windows API调用的行为恶意软件特征签名检测》中有详细描述。本项目是该方法的原型实现，并在硕士论文期间开发。签名由恶意软件分析师在dynmx签名DSL中手动定义，并可通过此工具在函数日志中检测。dynmx签名DSL的功能和语法也可在硕士论文中找到。此外，你可以在仓库dynmx-signatures中找到示例dynmx签名。除了基于API调用检测恶意软件特征外，dynmx还可以提取恶意软件使用的操作系统资源（所谓的访问活动模型）。这些资源通过检查API调用并重构对操作系统资源的操作来提取。目前，模型中考虑了文件系统、注册表和网络类别的操作系统资源。
以下部分展示了恶意软件特征检测和资源提取的示例。
对于此示例，我们选择SHA-256哈希和为c0832b1008aa0fc828654f9762e37bda019080cbdd92bd2453a05cfb3b79abb3的恶意软件样本。根据MalwareBazaar，该样本属于恶意软件家族Amadey。有一个公开的VMRay分析报告可用，其中还提供了VMRay跟踪的函数日志。此函数日志将是我们用于检测的数据基础。
如果我们想知道恶意软件样本是否使用了名为Process Hollowing的注入技术，我们可以尝试在函数日志中检测以下dynmx签名。```yaml dynmx_signature: meta: name: process_hollow title: Process Hollowing description: Detection of Process hollowing malware feature detection: proc_hollow: # Create legit process in suspended mode - api_call: ["CreateProcess[AW]", "CreateProcessInternal[AW]"] with: - argument: "dwCreationFlags" operation: "flag is set" value: 0x4 - return_value: "return" operation: "is not" value: 0 store: - name: "hProcess" as: "proc_handle" - name: "hThread" as: "thread_handle" # Injection of malicious code into memory of previously created process - variant: - path: # Allocate memory with read, write, execute permission - api_call: ["VirtualAllocEx", "VirtualAlloc", "(Nt|Zw)AllocateVirtualMemory"] with: - argument: ["hProcess", "ProcessHandle"] operation: "is" value: "$(proc_handle)" - argument: ["flProtect", "Protect"] operation: "is" value: 0x40 - api_call: ["WriteProcessMemory"] with: - argument: "hProcess" operation: "is" value: "$(proc_handle)" - api_call: ["SetThreadContext", "(Nt|Zw)SetContextThread"] with: - argument: "hThread" operation: "is" value: "$(thread_handle)" - path: # Map memory section with read, write, execute permission - api_call: "(Nt|Zw)MapViewOfSection" with: - argument: "ProcessHandle" operation: "is" value: "$(proc_handle)" - argument: "AccessProtection" operation: "is" value: 0x40 # Resume thread to run injected malicious code - api_call: ["ResumeThread", "(Nt|Zw)ResumeThread"] with: - argument: ["hThread", "ThreadHandle"] operation: "is" value: "$(thread_handle)" condition: proc_hollow as sequence
基于签名，我们可以发现一些使 *dynmx* 强大的 DSL 特性：
* 定义带有可选路径的 API 调用序列
* 使用正则表达式匹配 API 调用函数名
* 使用多个运算符匹配参数和返回值
* 存储变量，例如在 API 调用序列中跟踪句柄
* 使用布尔运算符（`AND`、`OR`、`NOT`）定义检测条件
如果我们使用上述签名对样本 `c0832b1008aa0fc828654f9762e37bda019080cbdd92bd2453a05cfb3b79abb3` 的函数运行 *dynmx*，则会得到以下输出，表明签名已被检测到。```
$ python3 dynmx.py detect -i 601941f00b194587c9e57c5fabaf1ef11596179bea007df9bdcdaa10f162cac9.json -s process_hollow.yml
|
__| _ _ _ _ _
/ | | | / |/ | / |/ |/ | /\/
\_/|_/ \_/|/ | |_/ | | |_/ /\_/
/|
\|
Ver. 0.5 (PoC), by 0x534a
[+] Parsing 1 function log(s)
[+] Loaded 1 dynmx signature(s)
[+] Starting detection process with 1 worker(s). This probably takes some time...
[+] Result
process_hollow c0832b1008aa0fc828654f9762e37bda019080cbdd92bd2453a05cfb3b79abb3.txt
通过将输出格式设置为 detail，我们可以获得更详细的信息。现在，我们可以在函数日志中看到检测到的精确 API 调用序列。此外，我们还可以看到签名在进程 51f0.exe 中被检测到。```
$ python3 dynmx.py -f detail detect -i 601941f00b194587c9e57c5fabaf1ef11596179bea007df9bdcdaa10f162cac9.json -s process_hollow.yml
|
__| _ _ _ _ _ / | | | / |/ | / |/ |/ | // _/|/ _/|/ | |/ | | |_/ /_/ /| |
Ver. 0.5 (PoC), by 0x534a
[+] Parsing 1 function log(s) [+] Loaded 1 dynmx signature(s) [+] Starting detection process with 1 worker(s). This probably takes some time...
[+] Result Function log: c0832b1008aa0fc828654f9762e37bda019080cbdd92bd2453a05cfb3b79abb3.txt Signature: process_hollow Process: 51f0.exe (PID: 3768) Number of Findings: 1 Finding 0 proc_hollow : API Call CreateProcessA (Function log line 20560, index 938) proc_hollow : API Call VirtualAllocEx (Function log line 20566, index 944) proc_hollow : API Call WriteProcessMemory (Function log line 20573, index 951) proc_hollow : API Call SetThreadContext (Function log line 20574, index 952) proc_hollow : API Call ResumeThread (Function log line 20575, index 953)
### 资源
为了从函数日志中提取访问的操作系统资源，我们可以简单地针对函数日志运行 *dynmx* 命令 `resources`。以下显示了SHA-256哈希和为 `601941f00b194587c9e57c5fabaf1ef11596179bea007df9bdcdaa10f162cac9` 的样本的详细输出示例。这是一个CAPE沙箱报告，属于[Avast-CTU Public CAPEv2 Dataset](https://github.com/avast/avast-ctu-cape-dataset)。```
$ python3 dynmx.py -f detail resources --input 601941f00b194587c9e57c5fabaf1ef11596179bea007df9bdcdaa10f162cac9.json
|
__| _ _ _ _ _
/ | | | / |/ | / |/ |/ | /\/
\_/|_/ \_/|/ | |_/ | | |_/ /\_/
/|
\|
Ver. 0.5 (PoC), by 0x534a
[+] Parsing 1 function log(s)
[+] Processing function log(s) with the command 'resources'...
[+] Result
Function log: 601941f00b194587c9e57c5fabaf1ef11596179bea007df9bdcdaa10f162cac9.json (/Users/sijansen/Documents/dev/dynmx_flogs/cape/Public_Avast_CTU_CAPEv2_Dataset_Full/extracted/601941f00b194587c9e57c5fabaf1ef11596179bea007df9bdcdaa10f162cac9.json)
Process: 601941F00B194587C9E5.exe (PID: 2008)
Filesystem:
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui (CREATE)
API-MS-Win-Core-LocalRegistry-L1-1-0.dll (EXECUTE)
C:\Windows\SysWOW64\ntdll.dll (READ)
USER32.dll (EXECUTE)
KERNEL32.dll (EXECUTE)
C:\Windows\Globalization\Sorting\sortdefault.nls (CREATE)
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\SourcePath (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\DevicePath (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableImprovedZoneCheck (READ)
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings (READ)
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only (READ)
Process: 601941F00B194587C9E5.exe (PID: 1800)
Filesystem:
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui (CREATE)
API-MS-Win-Core-LocalRegistry-L1-1-0.dll (EXECUTE)
C:\Windows\SysWOW64\ntdll.dll (READ)
USER32.dll (EXECUTE)
KERNEL32.dll (EXECUTE)
[...]
C:\Users\comp\AppData\Local\vscmouse (READ)
C:\Users\comp\AppData\Local\vscmouse\vscmouse.exe:Zone.Identifier (DELETE)
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup (READ)
[...]
Process: vscmouse.exe (PID: 900)
Filesystem:
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui (CREATE)
API-MS-Win-Core-LocalRegistry-L1-1-0.dll (EXECUTE)
C:\Windows\SysWOW64\ntdll.dll (READ)
USER32.dll (EXECUTE)
KERNEL32.dll (EXECUTE)
C:\Windows\Globalization\Sorting\sortdefault.nls (CREATE)
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\SourcePath (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\DevicePath (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableImprovedZoneCheck (READ)
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings (READ)
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only (READ)
Process: vscmouse.exe (PID: 3036)
Filesystem:
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui (CREATE)
API-MS-Win-Core-LocalRegistry-L1-1-0.dll (EXECUTE)
C:\Windows\SysWOW64\ntdll.dll (READ)
USER32.dll (EXECUTE)
KERNEL32.dll (EXECUTE)
C:\Windows\Globalization\Sorting\sortdefault.nls (CREATE)
C:\ (READ)
C:\Windows\System32\uxtheme.dll (EXECUTE)
dwmapi.dll (EXECUTE)
advapi32.dll (EXECUTE)
shell32.dll (EXECUTE)
C:\Users\comp\AppData\Local\vscmouse\vscmouse.exe (CREATE,READ)
C:\Users\comp\AppData\Local\iproppass\iproppass.exe (DELETE)
crypt32.dll (EXECUTE)
urlmon.dll (EXECUTE)
userenv.dll (EXECUTE)
wininet.dll (EXECUTE)
wtsapi32.dll (EXECUTE)
CRYPTSP.dll (EXECUTE)
CRYPTBASE.dll (EXECUTE)
ole32.dll (EXECUTE)
OLEAUT32.dll (EXECUTE)
C:\Windows\SysWOW64\oleaut32.dll (EXECUTE)
IPHLPAPI.DLL (EXECUTE)
DHCPCSVC.DLL (EXECUTE)
C:\Users\comp\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\ (CREATE)
C:\Users\comp\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk (CREATE,READ)
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT (READ)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup (READ)
[...]
Network:
24.151.31.150:465 (READ)
http://24.151.31.150:465 (READ,WRITE)
107.10.49.252:80 (READ)
http://107.10.49.252:80 (READ,WRITE)
根据显示的输出和访问的资源，我们可以推断出一些恶意软件特征：
601941F00B194587C9E5.exe (PID 1800) 中，文件 C:\Users\comp\AppData\Local\vscmouse\vscmouse.exe 的区域标识符被删除vscmouse.exe (PID: 3036) 连接到网络端点 http://24.151.31.150:465 和 http://107.10.49.252:80访问的资源对于识别基于主机和网络的检测指标很有价值。此外，资源可以用于 dynmx 签名。一个常见的例子是检测注册表中的持久化机制。``` dynmx_signature: meta: name: run_keys_persistence title: Run Keys Persistence description: Detection of persistence based on Registry Run Keys detection: run_keys: - resource: category: "registry" access_operations: ["write"] with: - attribute: "location" operation: "regex" value: "^(HKEY_CURRENT_USER|HKEY_LOCAL_MACHINE)\\Software\\Microsoft\\Windows\\CurrentVersion\\(Run|RunOnce|RunOnceEx)\\" startup_folders_keys: - resource: category: "registry" access_operations: ["write"] with: - attribute: "location" operation: "regex" value: "^(HKEY_CURRENT_USER|HKEY_LOCAL_MACHINE)\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\(Shell Folders|User Shell Folders)\\" condition: run_keys as simple or startup_folders_keys as simple
## 安装
要使用该软件，目标系统上必须安装 Python 3.9。此外，还需要安装以下 Python 包：
* `anytree`,
* `lxml`,
* `pyparsing`,
* `PyYAML`,
* `six` 和
* `stringcase`
要安装这些包，请运行下面显示的 `pip3` 命令。建议使用 Python 虚拟环境，而不是在系统范围安装这些包。```
pip3 install -r requirements.txt
使用该原型，只需运行主入口点 dynmx.py。使用信息可通过 -h 命令行参数查看，如下所示。```
$ python3 dynmx.py -h
usage: dynmx.py [-h] [--format {overview,detail}] [--show-log] [--log LOG] [--log-level {debug,info,error}] [--worker N] {detect,check,convert,stats,resources} ...
Detect dynmx signatures in dynamic program execution information (function logs)
optional arguments: -h, --help show this help message and exit --format {overview,detail}, -f {overview,detail} Output format --show-log Show all log output on stdout --log LOG, -l LOG log file --log-level {debug,info,error} Log level (default: info) --worker N, -w N Number of workers to spawn (default: number of processors - 2)
sub-commands: task to perform
{detect,check,convert,stats,resources} detect Detects a dynmx signature check Checks the syntax of dynmx signature(s) convert Converts function logs to the dynmx generic function log format stats Statistics of function logs resources Resource activity derived from function log
通常，如输出所示，可以定义多个关于日志处理、结果输出格式或多进程处理的命令行参数。此外，需要选择一个命令来运行特定任务。请注意，工作线程数量仅影响使用多进程处理的命令。目前，这些命令是 `detect` 和 `convert`。
每个命令都有特定的命令行参数，可以通过向命令添加参数 `-h` 来查看，例如下面的 `detect` 命令。```
$ python3 dynmx.py detect -h
usage: dynmx.py detect [-h] --sig SIG [SIG ...] --input INPUT [INPUT ...] [--recursive] [--json-result JSON_RESULT] [--runtime-result RUNTIME_RESULT] [--detect-all]
optional arguments:
-h, --help show this help message and exit
--recursive, -r Search for input files recursively
--json-result JSON_RESULT
JSON formatted result file
--runtime-result RUNTIME_RESULT
Runtime statistics file formatted in CSV
--detect-all Detect signature in all processes and do not stop after the first detection
required arguments:
--sig SIG [SIG ...], -s SIG [SIG ...]
dynmx signature(s) to detect
--input INPUT [INPUT ...], -i INPUT [INPUT ...]
Input files
作为 dynmx 的用户，您可以决定输出的结构。如果您选择通过定义参数 --show-log 在控制台显示日志，则输出包含两个部分（参见下面的列表）。首先显示日志，然后显示所用命令的结果。默认情况下，日志既不会显示在控制台中，也不会写入日志文件（可以使用 --log 参数定义）。由于多进程处理，日志文件中的条目不一定按时间顺序排列。```
|
__| _ _ _ _ _ / | | | / |/ | / |/ |/ | // _/|/ _/|/ | |/ | | |_/ /_/ /| |
Ver. 0.5 (PoC), by 0x534a
[+] Log output 2023-06-27 19:07:38,068+0000 [INFO] (main) [PID: 13315] []: Start of dynmx run [...] [+] End of log output
[+] Result [...]
结果输出的详细程度可以通过命令行参数 `--output-format` 定义，可以设置为 `overview` 获取概览结果，或设置为 `detail` 获取详细结果。例如，如果将输出格式定义为 `detail`，控制台中显示的检测结果将包含导致检测的具体API调用和资源。概览输出格式仅指示在哪个函数日志中检测到了什么签名。
## 示例命令行
使用一个工作进程检测函数日志中的 *dynmx* 签名```
python3 dynmx.py -w 1 detect -i "flog.txt" -s dynmx_signature.yml
将函数日志转换为 dynmx 通用函数日志格式``` python3 dynmx.py convert -i "flog.txt" -o /tmp/
检查签名（仅基本健全性检查）```
python3 dynmx.py check -s dynmx_signature.yml
根据函数日志（访问活动模型）获取恶意软件样本使用的资源详细列表。``` python3 dynmx.py -f detail resources -i "flog.txt"
## 故障排除
请注意，此工具是一个概念验证，是在撰写硕士论文之外开发的。因此，代码质量并非始终最佳，可能存在错误和缺陷。我尝试在给定的时间范围内尽可能使工具健壮。
解决错误的最佳方法是启用日志记录（在控制台和/或日志文件中），并将日志级别设置为 `debug`。异常处理程序应将详细错误信息写入日志，这有助于故障排除。