CheckPointSW/Cuckoo-AWS CheckPointSW/Cuckoo-AWS

  • Stars
    star
    134
  • Rank 270,967 (Top 6 %)
  • Language
    JavaScript
  • License
    Other
  • Created over 5 years ago
  • Updated over 2 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
CheckPointSW/Cuckoo-AWS
github

CheckPointSW

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Extension to Cuckoo Sandbox open source projects, adds support to AWS cloud functionalities and enables running emulation on auto-scaling infrastructure

Cuckoo SandBox on AWS

By Oran Kabarity @ Check Point Software Technologies

Overview

The project is an extension to Cuckoo Sandbox open source project; it adds support to AWS cloud functionalities and enables running emulations on auto-scaling infrastructure.

This blog post explains in detail the theory and functionality of Cuckoo Sandbox over AWS cloud.
https://research.checkpoint.com/cuckoo-system-on-aws/

Installation instructions - Nest Setup

• We added cloudformation stack: cuckoo-aws-cloudformation.yaml, All you need to do is running it and you will receive an EC2 instance with all the requirements installed in it

• Run cuckoo with debug output

cuckoo –d

• The first run should build the configuration files and save them in some location. The location is shown in the output of the run (should contain “.cuckoo” library). It is strongly advised to remember that location for the following steps and for future usages

• Edit ".cuckoo/conf/cuckoo.conf"

machinery = aws
[resultserver] ip = <the private IP of this machine>

• Edit ".cuckoo/conf/aws.conf" according to the instructions in the file

• Run

cuckoo

Image and snapshot setup

• Cuckoo are recommending to run guest VMs on 64-bit Windows 7. You can import your regular VM to AMI using this manual. https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html

• Launch a new Windows 7 instance to setup the guest

• Install Python and Pillow library https://cuckoo.sh/docs/installation/guest/requirements.html

• Disable Windows Firewall and the Automatic Updates https://cuckoo.sh/docs/installation/guest/network.html

• Install Cuckoo agent https://cuckoo.sh/docs/installation/guest/agent.html

• For malware network analysis, each guest should have the Nest as their default route

• Save this instace as a new image(AMI). This action will also create a new snapshot(snapshot-id can be found under the AMI details)

Changes from official Cuckoo repository

In order to make it compatible with AWS we made the following changes.

• Added a new machinery (at cuckoo/machinery/aws.py)

• Added a new config template (at cuckoo/private/cwd/conf/aws.conf)

• Modified the config object (at cuckoo/common/config.py) in a way that will support the new configuration file.

More Repositories

1

Karta

Karta - source code assisted fast binary matching plugin for IDA
Python
854
star
2

InviZzzible

InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.
C++
530
star
3

Evasions

Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.
HTML
374
star
4

android_unpacker

A (hopefully) generic unpacker for packed Android apps.
Shell
355
star
5

showstopper

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.
C++
193
star
6

Scout

Scout - Instruction based research debugger (a poor man's debugger)
C
149
star
7

CloudGuardIaaS

Check Point CloudGuard Network Security repository containing solution templates, Terraform templates, tools and scripts for deploying and configuring CloudGuard Network Security products.
HCL
94
star
8

cp_mgmt_api_python_sdk

Check Point API Python Development Kit simplifies the use of the Check Point Management APIs.
Python
93
star
9

cpAnsible

Ansible module provides control over a Check Point Management server using Check Point's web-services APIs.
Python
67
star
10

ExportImportPolicyPackage

Check Point ExportImportPolicyPackage tool enables you to export a policy package from a Management database to a .tar.gz file, which can then be imported into any other Management database. The tool is supported for version R80.10 and above.
Python
58
star
11

QueryOrientedProgramming

Query Oriented Programming (QOP) gadgets for SQLite-based exploitation
Python
49
star
12

Anti-Debug-DB

Anti-Debug encyclopedia contains methods used by malware to verify if they are executed under debugging. It includes the description of various anti-debug tricks, their implementation, and recommendations of how to mitigate the each trick.
HTML
45
star
13

SmartMove

Check Point SmartMove tool enables you to convert 3rd party database with firewall security policy and NAT to Check Point database.
C#
42
star
14

CheckPointAnsibleMgmtCollection

This Ansible collection provides control over a Check Point Management server using Check Point's web-services APIs.
Python
39
star
15

Cyber-Research

General purpose repository for miscellaneous scripts, pcaps and malware IOCs that we share with the info-sec research community
Python
37
star
16

MacOS-MalwarePedia

HTML
32
star
17

android_appfuzz

Shell
30
star
18

ShowPolicyPackage

Check Point ShowPolicyPackage tool shows the content of a policy package (layers, rulebase, objects) over HTML pages.
Java
29
star
19

terraform-provider-checkpoint

Terraform provider for Check Point
Go
27
star
20

reputation-service-api

Leverage the Check Point’s threat intelligence to enrich your SIEM and SOAR solutions and to secure your business applications and websites by using simple RESTful APIs.
Java
27
star
21

PolicyCleanUp

Check Point PolicyCleanUp tool allows automatic cleanup of your policy based on hits count.
Python
25
star
22

smart-console-extensions

An extension can use JavaScript to interact with SmartConsole. The interactions provide access to information, such as the extension location context, and can perform certain basic operations. For example, navigate to a rule. Interactions can return data asynchronously by matching callbacks.
TypeScript
22
star
23

CheckPointAnsibleGAIACollection

An Ansible collection provides control over a Check Point machine using Check Point's web-services APIs.
Python
20
star
24

charts

Deploy Kubernetes Helm Charts for Check Point CloudGuard
Smarty
18
star
25

ExportObjects

Check Point ExportObjects tool enables you to export specific types of objects from a R80.10 and above Management database to a .csv file, which can then be imported into any other R80.10 and above Management database.
Python
15
star
26

UsefulManagementApiTools

Check Point Useful Management API Tools contain scripts and tools that were used as solutions for customers.
Python
12
star
27

dynobj

Python
8
star
28

flash_instrumentation

ActionScript
8
star
29

Infinity-Next

Python
8
star
30

cpmonitor

CPMonitor is a utility targeted to analyze traffic captured by tcpdump (www.tcpdump.org) / snoop (http://snoopwpf.codeplex.com/).
C
8
star
31

cp-mgmt-api-csharp-sdk

Check Point API C# Development Kit
C#
6
star
32

terraform-checkpoint-dynobj-nia

Check Point Software Technologies Dynamic Objects module for Network Infrastructure Automation (NIA)
Shell
6
star
33

sddc

Python
6
star
34

cp-mgmt-api-go-sdk

Check Point API Go Development Kit simplifies the use of the Check Point Management APIs
Go
6
star
35

terraform-provider-infinity-next

Infinity Next's Terraform Provider for managing CloudGuard AppSec and other Infinity Next security application using Terraform.
Go
6
star
36

ChangedPolicies

Check Point ChangedPolicies tool allows the user to know which policies were affected by changes that were made in the last published session.
Python
5
star
37

teapi

An example of the Threat Prevention API implementation for Java & Python
Python
4
star
38

sourceguard-action

SourceGuard is designed to leverage Check Point's varied prevention technologies and services, providing source-code security and visibility. With a simple, cross-platform CLI tool users can customize exclusions and control an ignore list with easy integration into any pipeline.
4
star
39

chkp_nano_agents

C
3
star
40

infinity-next-terraform-cli

Utility CLI for the Infinity Next Terraform Provider
Go
3
star
41

cp-mgmt-api-java-sdk

Check Point API Java Development Kit simplifies the usage of the Check Point R80.10 Management APIs.
Java
3
star
42

LocalToGlobal

Check Point LocalToGlobal tool enables you to copy objects from a local domain to the global domain.
Python
2
star
43

cp-mgmt-api-typescript-sdk

Check Point API Typescript Development Kit simplifies the use of the Check Point Management APIs. The kit contains the API library files, and sample files demonstrating the capabilities of the library.
TypeScript
2
star
44

appliance_tpapi

Client side utilities for using Check Point Threat Prevention API calls to an appliance.
Python
2
star
45

harmony-endpoint-management-js-ts-sdk

Check Point's Harmony Endpoint management SDK for JavaScript ecosystem
TypeScript
2
star
46

spectral-github-action

Automated Secrets, Misconfiguration, IaC Misconfiguration detection, and OSS by Check Point CloudGuard
JavaScript
1
star
47

infinitynext-mgmt-api-resources

Resources and example for using Check Point Infinity Next API. For API reference and GraphiQL tool, login into the product and navigate to Support->API Content
1
star
48

Check_Point_App_for_Splunk

CSS
1
star
49

sdn

Python
1
star
50

harmony-endpoint-management-py-sdk

Check Point's Harmony Endpoint management SDK for Python ecosystem
Python
1
star