Skip to content

Improve TUI rendering and add forensic analysis features #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Samuele95 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Improve TUI rendering and add forensic analysis features #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,15 @@ sudo ./malware_scan.sh -i
║ [ ] Rootkit detection (requires mount) ║
║ [ ] Generate file timeline ║
╟──────────────────────────────────────────────────────────────────────╢
║ FORENSIC ANALYSIS (Windows artifacts) ║
╟──────────────────────────────────────────────────────────────────────╢
║ [ ] Full forensic analysis (enables all below) ║
║ [ ] Persistence artifacts (registry, tasks, services) ║
║ [ ] Execution artifacts (prefetch, amcache, shimcache) ║
║ [ ] File anomalies (timestomping, ADS, suspicious paths) ║
║ [ ] RE triage (capa, imports, entropy) ║
║ [ ] MFT/filesystem forensics (deleted files, USN journal) ║
╟──────────────────────────────────────────────────────────────────────╢
║ OUTPUT ║
╟──────────────────────────────────────────────────────────────────────╢
║ [✓] Generate HTML report ║
Expand Down Expand Up @@ -306,6 +315,28 @@ sudo dms --interactive
| :floppy_disk: | **Slack Space Recovery** | Extract and analyze unallocated disk space for hidden threats |
| :globe_with_meridians: | **VirusTotal Integration** | Automatic hash lookup via VT API for threat intelligence |
| :arrows_counterclockwise: | **Checkpoint/Resume** | Resume interrupted scans without losing progress |
| :mag_right: | **Forensic Analysis** | Persistence, execution artifacts, RE triage, MFT analysis |

### Behavioral & Forensic Analysis (NEW)

DMS now includes comprehensive **behavioral and forensic analysis** for Windows artifacts:

| Module | Artifacts Analyzed | MITRE ATT&CK |
|--------|-------------------|--------------|
| **Persistence Scan** | Registry Run keys, Services, Scheduled Tasks, Startup folders, WMI subscriptions | T1547, T1543, T1053, T1546 |
| **Execution Scan** | Prefetch, Amcache, Shimcache, UserAssist, SRUM, BAM/DAM | T1059, T1204 |
| **File Anomalies** | Magic/extension mismatch, ADS, timestomping, suspicious paths, packed executables | T1036, T1070, T1564 |
| **RE Triage** | capa analysis, suspicious imports (process injection/hollowing), similarity hashes, shellcode detection | T1055, T1055.012 |
| **MFT Forensics** | Deleted file recovery, $MFT parsing, $UsnJrnl analysis, timestamp anomalies | T1070, T1485 |

```bash
# Enable all forensic modules
sudo ./malware_scan.sh evidence.E01 --forensic-analysis

# Or enable specific modules
sudo ./malware_scan.sh /dev/sdb1 --persistence-scan --execution-scan
sudo ./malware_scan.sh evidence.E01 --re-triage --mft-analysis
```

---

Expand Down Expand Up @@ -698,6 +729,12 @@ All standard scans PLUS:
| `--log-file FILE` | | Write logs to file |
| `--output FILE` | `-o` | Custom output path |
| `--dry-run` | | Preview without executing |
| `--forensic-analysis` | | **Enable all forensic modules** |
| `--persistence-scan` | | Scan for persistence mechanisms |
| `--execution-scan` | | Analyze execution artifacts |
| `--file-anomalies` | | Detect file anomalies/timestomping |
| `--re-triage` | | RE triage on suspicious files |
| `--mft-analysis` | | MFT/filesystem forensics |

---

Expand Down
Loading