Method for interfering malicious program

Abstract

The invention relates to a method for interfering a malicious program in the technical field of network security, which comprises the following steps of: acquiring malicious program heap information according to a CS malicious program process, performing feature analysis to obtain malicious program memory features, and compiling the malicious program memory features into a detection rule; traversing heap information of each process memory when the host runs, and scanning out a memory malicious program process according to a detection rule; obtaining an initial configuration file from the memory malicious program process, and decrypting the initial configuration file to obtain a decrypted configuration file; constructing a plurality of groups of interference request packets according to the decryption configuration file, and repeatedly sending the plurality of groups of interference request packets to the server; whether the server side issues an attacker task or not is judged, if yes, an interference result is constructed and sent to the server side, and if not, the interference request packet is continuously and repeatedly sent to the server side, and the bottleneck that an existing safety product only has a rogue program detection function and cannot be confronted with rogue programs is broken through.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method for interfering with malicious programs. Background technique [0002] CobaltStrike (CS for short), as a penetration testing artifact, adopts C / S architecture and can perform distributed team collaboration. CS integrates powerful functions such as port forwarding, service scanning, automatic overflow, multi-mode port monitoring, Windows exe and dll Trojan generation, Java Trojan generation, Office macro virus generation, Trojan bundling, etc., and is deeply loved by the majority of red team students. [0003] At present, in order to prevent the interference of the CS malicious program, the method of identifying the CS malicious program is usually used to prevent it. However, even if the CS malicious program can be quickly identified, it is still impossible to fight against the malicious program, so that the attacker will still By continuously download...

AI Technical Summary

Problems solved by technology

[0003] At present, in order to prevent the interference of the CS malicious program, the method of identifying the CS malicious program is usually used to prevent it. However, even if the CS malicious program can be quickly identified, it is still impossible to fight against the malicious program, so that the attacker will still By continuously downloading CS malicious programs, in an attempt to achieve the ultimate goal of controlling the host

Images