Cuckoo: [Idea] Honeypot mode for Cuckoo

[Tigzy]

Hello,
With friends we were wondering if it could be possible to develop a special mode for Cuckoo (so-called "Honeypot mode" ), that would have the following behavior:

• Have a list of processes to inject (lsass, explorer, web-browsers -pre-launched-) at start from config. Those processes would be injected as soon as the machine starts.
• No initial timeout
• Once a monitored process gets exploited (child process creation, or thread?) the timer starts and the actual analysis begins.
• Then, the cuckoo machine behaves like normal analysis, considering the submission item as being the child process that popped out of the monitored processes. So after it ends, or after the timeout is hit, analysis stops and the reports are created.
• At the end of the reporting, the machine restarts from snapshot.

I don't think it would be impossible to do when I'm looking at the current code, but honestly everyone would love it !! :)

[ghost]

That would be a great feature to see

[Tigzy]

No feedback for this? :/ I can give a hand on this, I know python coding and I've spent countless hours customizing Cuckoo with modules :)

[doomedraven]

check long_cuckoo in @jbremer repos, that maybe kinda what you want, just my 2 cents ;)

[Tigzy]

Thanks, but I believe the fork is now completely out of sync with the current Cuckoo 2.0 ?

[doomedraven]

no idea i don't tracki the dev of that one, but that can help in dev if you will start do honey style cuckoo :)

[jbremer]

Sorry for the late reply, but yes, this would be an interesting project and is on our todo list. Whether we'll actually get to work on this next year, I'm not sure yet. Let's wait & see ;-)

[jbremer]

Just for your information, we are in fact working on this now. If you'd like to share/request some ideas/features on use-cases or implementation, then please do let us know. I can also invite you for our Slack btw (give me your email address or send me an email at [email protected]).

[Tigzy]

@jbremer thanks, will send you my email for the Slack channel