MalwLess Simulation Tool (MST)

MalwLess is an open source tool that allows you to simulate system compromise or attack behaviors without running processes or PoCs. The tool is designed to test Blue Team detections and SIEM correlation rules. It provides a framework based on rules that anyone can write, so when a new technique or attack comes out you can write your own rules and share it a with the community.

These rules can simulate Sysmon or PowerShell events. MalwLess can parse the rules and write them directly to the Windows EventLog, then you can forward it to your event collector.

Changelog v2.3

• Merge pull request #9 from n0dec/fix01
• fixing contents field

Requirements

It is necessary to have sysmon installed in your system.

Use

Commands

To test the default rule set which is on rule_test.json just download it and run:

> malwless.exe

If you want to test a different rule set file, use the -r parameter:

> malwless.exe -r your_pack.json

To write a custom rule set check the writing sets section.

Creating rules

Anyone can create a rule. These are written in json with an easy format.

Rule example

  "process_create_rule": {

    "enabled": true,

    "source": "Sysmon",

    "category": "Process Create",

    "description": "Activity event based on Process Create category.",

    "payload": {

      "Image": "process.exe",

      "CommandLine": "process.exe --help"

    }

  }

Download

Copyright (C) 2018 n0dec

Source: https://github.com/n0dec/