forensicnomicon 0.2.1

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

use crate::threat_intel::{
    profile::{MalwareClass, MalwareProfile, ProfileSignal, WeightedExclusion},
    signals::*,
};

pub static AZAZEL: MalwareProfile = MalwareProfile {
    id: "azazel",
    family: "Azazel",
    aliases: &["azazel-rootkit"],
    description: "LD_PRELOAD rootkit similar to Father: process hiding + PAM credential theft. \
                  Distinguishable from Father by absence of the Father staging format and \
                  presence of magic-packet backdoor activation.",
    malware_class: MalwareClass::LdPreloadPamHooker,
    mitre_techniques: &["T1574.006", "T1014", "T1556.003", "T1205.001"],
    signals: &[
        ProfileSignal {
            id: ELF_HOOKS_PROCESS_HIDING,
            weight: 20,
            required: true,
        },
        ProfileSignal {
            id: ELF_HOOKS_PAM_CREDENTIAL,
            weight: 30,
            required: true,
        },
        ProfileSignal {
            id: ELF_GLOBALLY_LOADED,
            weight: 10,
            required: false,
        },
        ProfileSignal {
            id: ELF_NOT_IN_PKG_DB,
            weight: 10,
            required: false,
        },
        ProfileSignal {
            id: NETWORK_MAGIC_PACKET_KNOCK,
            weight: 25,
            required: false,
        },
    ],
    exclusions: &[
        WeightedExclusion {
            id: ARTIFACT_PAM_STAGING_FATHER,
            penalty: 20,
        },
        WeightedExclusion {
            id: ELF_STRING_FATHER_FORMAT,
            penalty: 15,
        },
    ],
    class_threshold: 50,
    probable_threshold: 70,
    confirmed_threshold: 85,
};