Cuckoo: Improve reporting comprehension by hiding non-malicious IPs and domains

[michelepetito]

Hello guys! Many IPs and non-malicious domains appear in the reports. As a test I submitted the URL http://www.google.com and these IPs appear in the report:

52.199.19.161 Active Moloch
204.79.197.229 Active Moloch
216.58.198.34 Active Moloch
216.58.205.100 Active Moloch
216.58.205.131 Active Moloch
216.58.205.142 Active Moloch
216.58.205.195 Active Moloch
216.58.205.35 Active Moloch
40.67.186.102 Active Moloch
65.55.252.93 Active Moloch

and domains like bing.com, gstatic.com, dns.msftncsi.com, adservice.google.com, and many other indicators not useful for analysis.

It would be ideal to create a whitelist for IP / domains related to companies and products recognized as reliable (for example Adobe, Microsoft, Google etc.).

Not being a developer, I can not tell you how to implement this function, but the ideal would be to create two views of the report: an "advanced view" containing all the activity and a "filtered view" based on whitelist.

screencapture2018-09-11-12_33_06.zip

[doomedraven]

you can whitelist them on your side + you can disble many services which generates that noise

[michelepetito]

Thank you so much for the suggestions. In fact I had already tried several times in Cuckoosand's documentation if there was a way to provide a whitelist to cuckoo but I did not find anything. Can you tell me how to do it?

Regarding the services to be disabled, in Windows 7 SP1 I had already disabled some such as "Windows Search", "Windows Error Reporting Service", "IP Helper" and others. Could you suggest a complete list of services to disable in Windows 8 and WIndows 10 in order to reduce noise to a minimum?

[doomedraven]

see this https://github.com/cuckoosandbox/cuckoo/search?q=whitelist&unscoped_q=whitelist

can't help with win8/10 but maybe part of this can be useful

REM HELP
REM http://www.windows-commandline.com/start-stop-service-command-line/
REM disable UAC
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
REM disable Windows defender
sc config WinDefend start= disabled
REM disable windows update
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 1 /f
REM disable aero
net stop uxsms
REM disable the firewall
netsh firewall set opmode mode=DISABLE
REM disable IPv6
netsh interface teredo set state disabled
netsh interface ipv6 6to4 set state state=disabled undoonstop=disabled
netsh interface ipv6 isatap set state state=disabled
REM disable active probing
reg add  "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v EnableActiveProbing /t REG_DWORD /d 0 /f
REM disable SSDP
sc config SSDPSRV start= disabled
net stop SSDPSRV
REM disable computer browsing
sc stop Browser
sc config Browser start= disabled
REM disable WinHTTP Web Proxy Auto-Discovery
reg add "HKLM\SYSTEM\CurrentControlSet\services\WinHttpAutoProxySvc" /v Start /t REG_DWORD /d 4 /f
REM disable Function Discovery Resource Publication service
reg add "HKLM\SYSTEM\CurrentControlSet\services\FDResPud" /v Start /t REG_DWORD /d 4 /f
REM IE blank page
reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /V "Start Page" /D "" /F
REM disable IExplorer Proxy
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t  REG_DWORD /d 00000000 /f
REM disable netbios in TCP/IP
wmic nicconfig where index=8 call SetTcpipNetbios 2
REM disable netbios service
reg add "HKLM\SYSTEM\CurrentControlSet\services\Imhosts" /v Start /t REG_DWORD /d 4 /f
REM disable LLMNR
reg add "HKLM\Software\policies\Microsoft\Windows NT\DNSClient" /v "EnableMulticast" /t REG_DWORD /d "0" /f
REMdisable SQM
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FlexGo\FGNotify\Prechecks"  /v Sqm /t REG_DWORD /d 00000002 /f
REM Disable cert check
reg add "HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo" /v DefaultSslCertCheckMode /t REG_DWORD /d 1 /f

[michelepetito]

Thanks so much. I solved by editing the file https://github.com/cuckoosandbox/cuckoo/blob/master/cuckoo/private/whitelist/domain.txt and enabling "dnswhitelist = on" in .cuckoo / conf / processing.conf.

I found other useful information in this issue https://github.com/spender-sandbox/cuckoo-modified/issues/433