forensicnomicon 0.2.2

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

use crate::threat_intel::{
    profile::{MalwareClass, MalwareProfile, ProfileSignal},
    signals::*,
};

pub static LKM_GENERIC: MalwareProfile = MalwareProfile {
    id: "lkm_generic",
    family: "LKM Rootkit",
    aliases: &["diamorphine", "reptile", "suterusu", "knark", "adore"],
    description: "Loadable Kernel Module rootkit. Sets kernel taint bits. May hide \
                  itself from /proc/modules. Includes Diamorphine, Reptile, Suterusu, \
                  and similar kernel-space implants.",
    malware_class: MalwareClass::LkmRootkit,
    mitre_techniques: &["T1215", "T1014"],
    signals: &[
        ProfileSignal {
            id: SYSTEM_KERNEL_TAINT_OOT,
            weight: 30,
            required: true,
        },
        ProfileSignal {
            id: SYSTEM_PROC_MODULES_SUSPECT,
            weight: 40,
            required: false,
        },
        ProfileSignal {
            id: PROCESS_HIDDEN_FROM_PS,
            weight: 20,
            required: false,
        },
        ProfileSignal {
            id: SYSTEM_KERNEL_TAINT_FORCED,
            weight: 15,
            required: false,
        },
    ],
    exclusions: &[],
    class_threshold: 30,
    probable_threshold: 55,
    confirmed_threshold: 75,
};