Stealth mode - Githubissues

tomchop / malcom

Malcom - Malware Communications Analyzer

Other

1.15k stars 215 forks source link

Stealth mode #18

Open tomchop opened 10 years ago

tomchop commented 10 years ago

Add a switch to make sure Malcom does not communicate with external infrastructure:

Prevent rDNS when sniffing and detecting IPs
Prevent DNS resolutions in analytics module
Prevent IP to AS resolutions
Make all the above configurable?

DigiAngel commented 7 years ago

Oh yes please on this. After starting the docker instance over 10K dns requests start...it would be nice to not have malcom do this. Thank you!

tomchop commented 7 years ago

Unfortunately I have less and less time to allocate to malcom. Doing this should not be very complicated - a switch in the configuration file and conditions on the analytics. I'll see if I can do it soon-ish, otherwise I'm happy to receive PRs :)