search

brad-sp / community-modified

Modified edition of cuckoo community modules
31 stars 17 forks source link

Add API call details when signature matches #144

Open tsmolka opened 9 years ago

tsmolka commented 9 years ago

As you know Cuckoo offers (since 1.2 or 1.3 I believe) Signature.add_match() method for marking process and data (e.g. API call) that triggered the signature. In practice this sometimes gives pretty detailed background on why the signature was actually triggered.

Is there any reason why there are currently no signatures using this helper method? In many cases the change is quite trivial without negative impact.

Sample output when antiav_avast_libs matches on sample 0598ee3e06c681d7f9e05d83bb7ea422. screen shot 11-02-15 18-06-26

Commit a625e90 updates just first three signatures, the rest (at least where change is trivial) would follow.

brad-sp commented 9 years ago

The signature API was updated at the same time of a mass conversion of all signatures to use the new API -- I didn't (and don't) feel that it really contributed anything useful to the majority of signatures other than adding more clutter to the interface. More important was fixing the numerous errors in many of the signatures that still weren't fixed during that mass conversion.

I'm of the feeling that if a signature is to provide additional information, it should involve some significant processing (like the Dyre C2 display) vs just adding standard tables of API logs.