{"repo":"CheckPointSW/Evasions","free":true,"listed":false,"github":"https://github.com/CheckPointSW/Evasions","clone":"git clone https://github.com/CheckPointSW/Evasions.git","description":"Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.","language":"HTML","stars":449,"topics":["evasions","anti-analysis","anti-vm","anti-emulation","anti-sandbox","malware","sandbox-evasion","vm-detect"],"license":"MIT","category":"dev-tools","readme_excerpt":"Encyclopedia of Evasions Words of gratitude This encyclopedia wouldn't be possible without invaluable assistance of the following Check Point researchers: Aliaksandr Trafimchuk ([@a14xt][a14xt]) Bohdan Melnykov ([@\\ mbv06\\ ][\\ mbv06\\ ]) Site Compiled encyclopedia resides here: https://evasions.checkpoint.com. Windows Evasions repository As malicious threats evolve, the necessity in automated solutions to analyze such threats emerges. It's a very common case when malware samples are executed in some kind of virtualized environment. These environments differ from usual host systems by a huge amount of artifacts: non-common files, registry keys, system objects, etc. By examining such artifacts malware samples are able to say if they are run in a virtualized environment. Depending on the answer to this question, malware will continue its usual execution thus giving the researchers an opportunity to monitor its behavior - or will behave itself in an unexpected way and reveal nothing about its behavior. If the latter was the case, we say that malware has successfully applied evasion technique, or simply evasion. In this encyclopedia we have attempted to gather all the known ways to detect virtualized environment grouping them into big categories. Some categories are inactive on main page: it means that content will be added later. Within each category the reader will find the following information: description of the technique code sample showing its usage signature recommendations","default_branch":null,"files":null,"tree":[],"storefront":"/r/CheckPointSW","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/CheckPointSW/Evasions/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}