Flerken is an Open-source obfuscated command detection tool. Command line obfuscation has been proved to be a non-negligible factor in file-less malware or malicious actors that are “living off the land”.
To bypass signature-based detection, dedicated obfuscation techniques are shown to be used by red-team penetrations and even APT activities.
Meanwhile, numerous obfuscators (namely tools perform syntax transformation) are open sourced, thus making obfuscating given commands increasingly effortless.
However, the number of suitable defenses remains to be few. For Linux command line obfuscation,we can barely find any detection tools.
Concerning defenses against Windows command obfuscation, existing schemes turn out to either lack of toolization, or only partially resolve the entire problem, sometimes even inaccurately.
To better facilitate obfuscation detection, we have proposed Flerken, a toolized platform that can be used to detect both Windows (CMD and Powershell) and Linux (Bash) commands.
The name of Flerken is inspired by a cat-like yet extremely powerful creature from Marvel world. Flerken is build on the basis of carefully collection of black/white samples, and can be divided into two sub-schemes, namely Kindle (Windows obfuscation detector) and Octopus (Linux obfuscation detector).
To help optimize Flerken’s classification performance, we adopt techniques such as machine learning, bi-directional feature filter ring, script sandboxing.
Also Read : NAXSI : WAF For NGINX
Quick start : Installation
[root@server:~$] python -V
[root@server:~$] pip install -r requirement.txt
source /your path/Flerken/flerken/lib/flerken.sql
Path: flerken/config/global_config.py
[root@server:~$] python runApp.py
Path: flerken/config/whitelists/
How to use
It’s very easy to use as shown in the following picture, and we will also release API interfaces as soon.\
Build-in 3rd parties
Credits: Yao Zhang, Zhiyang Zeng
The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…
Introduction In digital investigations, images often hold more information than meets the eye. With the…
The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…
What is a Port? A port in networking acts like a gateway that directs data…
The ls command is fundamental for anyone working with Linux. It’s used to display the files and…
The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…