Threats Tagged 'yara'

ICMP-Ghost is an open-source tunnelling framework that uses ICMP and DNS protocols for command and control (C2) communication. It is designed in x64 assembly and claims to evade endpoint detection and network intrusion detection systems. The framework supports dual-channel C2 with the ability to switch between ICMPv4 and DNS tunnelling on the fly. Detection rules using PacketSmith Yara-X modules have been developed to identify traffic generated by this framework.

This content is a walkthrough and educational lab setup for hunting the Zeus Banking Trojan using tools like Suricata, Splunk, Volatility, and YARA. It details a hands-on malware analysis and detection engineering pipeline involving a Windows victim VM with Sysmon and an Ubuntu VM running Splunk Enterprise and Suricata IDS. The write-up is intended for defensive security study and SOC portfolio development.