3 ms·
I'm not so sure about that. WL released the documentation back in April, which contained more than enough information to create a few behavioral detection signa
by willstrafach 9y ago
I'm not so sure about that. WL released the documentation back in April, which contained more than enough information to create a few behavioral detection signatures for the implants. I would assume that any AV company who cared has already created and deployed signatures.
- 45h34jh53k4j 9y agoHi chronic, We now know that all comms implant to C2 are TLS with a unique (fake) certificate tree. They use unique, single use domains for operations. I don't believe there was enough information in vault 7 to identify IOC's that could be used for behavioural analysis. We also now know that the C2 fronting servers negotiate 'Client Cert optional', which is a fairly unique configuration item. The git repo contains 3 binary builds of the client/server malware. I think this is more important for detection than their docs. Regardless, its all public domain now.
- willstrafach 9y agoAV is now far beyond just using hash-based detection, but you are correct that having the three binary builds will allow that to also be added to their (hopefully existing) detections. No argument there. What you're saying comes from the documentation included in the source, yes. But if you dig into the Confluence dump from back in March, you'll see that the User's Guide and Developer's Guide PDFs for Hive were attached to one of the wiki pages already, explaining how this all worked. It did not get any press attention as it was quite mundane compared to the more interesting leaked wiki pages, but I would really hope AV companies and others in infosec noticed this already.