🛡️ SilentGuard v2 — Windows Malware Analyzer

Passive, read-only Windows malware scanner with live threat intelligence, YARA rule engine, and real-time browser dashboard.

---

✨ What SilentGuard Does

SilentGuard is a 100% read-only malware scanner that runs in a browser dashboard. It never modifies your system — it only observes and reports. Think of it as a lightweight, self-hosted threat detection console.

Start SilentGuard → Click "Scan" → Get threat report in your browser

Detection layers:

Layer	What it checks	Intel source
🔍 Process scan	Process names, paths, CPU heuristics	SilentGuard signatures
🧬 YARA scanning	Binary patterns in process executables	Neo23x0 · Elastic · ReversingLabs
#️⃣ Hash intel	SHA256 of running binaries vs malware DB	MalwareBazaar (1M+ samples)
🗝️ Registry persistence	Run keys · Winlogon · AppInit_DLLs	Built-in heuristics
📡 Network correlation	Active connections vs C2 IP blocklist	FeodoTracker · ThreatFox
📁 File scan	YARA + hash check on Temp/Startup dirs	MalwareBazaar · YARA

---

🆚 v1 → v2 Improvements

Feature	v1	v2
Hash database	2 hardcoded hashes	MalwareBazaar (live, 1M+ samples)
C2 detection	Port list only	FeodoTracker IP blocklist (live)
IOC matching	None	ThreatFox 7-day IOC feed
YARA scanning	None	Neo23x0 + Elastic + ReversingLabs + 12 built-in rules
Malicious URLs	None	URLhaus active feed
VirusTotal	None	Optional hash lookup (free API key)
Feed caching	None	6-hour local cache (works offline)
UI	Basic table	Real-time SSE dashboard with severity cards

---

🚀 Quick Start

1. Clone & install

git clone https://github.com/YOUR_USERNAME/silentguard.git
cd silentguard
pip install -r requirements.txt

Windows YARA install note: If yara-python fails:

pip install yara-python --pre
# or download pre-built wheel from:
# https://github.com/VirusTotal/yara-python/releases

2. (Optional) Set VirusTotal API key

Free key at virustotal.com — 500 lookups/day

# Windows
set VT_API_KEY=your_free_key_here

# Linux / Mac
export VT_API_KEY=your_free_key_here

3. Run

# Windows (recommended: run as Administrator for full access)
python app.py

# Or press F5 in VS Code (launch.json included)

4. Open dashboard

http://127.0.0.1:5000

On first run, SilentGuard downloads:

• MalwareBazaar recent hashes (~15s)
• FeodoTracker C2 IP blocklist
• ThreatFox IOCs (last 7 days)
• URLhaus malicious URLs
• YARA rules from GitHub (Neo23x0, Elastic, ReversingLabs)

Then caches locally for 6 hours. Subsequent scans are instant.

---

📸 Dashboard

Demo mode is active on non-Windows machines — shows realistic threat report without running actual scans.

The dashboard shows:

• Threat cards — severity badge, affected process/file, registry path, detection source, MITRE technique, and step-by-step remediation guide
• Network tab — all active connections with C2/clean/suspicious tags
• Activity log — real-time SSE scan progress
• Stats bar — processes scanned, YARA hits, intel feed counts

---

🏗️ Project Structure

silentguard/
├── app.py                    ← Flask backend + MalwareScanner engine (838 lines)
├── yara_engine.py            ← YARA rule compiler + scanner
├── requirements.txt
│
├── intel/
│   ├── threat_feeds.py       ← Feed fetcher: MalwareBazaar, FeodoTracker, ThreatFox, URLhaus
│   ├── cache.json            ← Auto-generated local intel cache (gitignored)
│   └── __init__.py
│
├── yara_rules/
│   ├── 00_builtin_rules.yar  ← 12 always-available rules (no internet needed)
│   ├── Neo23x0_signature-base/   ← Downloaded on first run
│   ├── Elastic_detection-rules/  ← Downloaded on first run
│   └── reversinglabs_yara/       ← Downloaded on first run
│
└── templates/
    └── index.html            ← Dashboard UI (single-page, vanilla JS + SSE)

---

🔍 Detection Engine Deep-Dive

A. Process Scan

Five detection checks per process:

# 1. Name signature match
if name in SUSPICIOUS_PROCESS_NAMES:
    # svchost32.exe, mimikatz.exe, meterpreter.exe, xmrig.exe, etc.

# 2. Suspicious path heuristic
if _is_suspicious_path(exe):
    # AppData\Local\Temp, C:\Windows\Temp, C:\Users\Public, etc.

# 3. Hash check vs MalwareBazaar
sha256 = hashlib.sha256(open(exe,"rb").read(512*1024)).hexdigest()
if sha256 in known_hashes:  # critical alert

# 4. YARA binary scan
yara_matches = yara_eng.scan_file(exe)

# 5. CPU spike heuristic (cryptominer detection)
if proc.cpu_percent(interval=0.05) > 75:

B. YARA Engine

Compiles all .yar / .yara files from yara_rules/ into a single ruleset:

yara_rules/
├── 00_builtin_rules.yar     → 12 rules (keylogger APIs, shellcode, miner strings)
├── Neo23x0_signature-base/  → gen_rats, gen_ransomware, gen_mimikatz, gen_meterpreter, gen_cryptominer
├── Elastic_detection-rules/ → Emotet, WannaCry, Cobalt Strike, Metasploit, Cryptominer
└── reversinglabs_yara/      → Locky, WannaCryptor, Emotet

Invalid rules are skipped automatically — compilation never fails on a bad rule file.

C. Threat Intel Feeds

Feed	URL	What it provides
MalwareBazaar	mb-api.abuse.ch/api/v1/	Recent 100 samples: SHA256 + signature + tags
FeodoTracker	feodotracker.abuse.ch/downloads/ipblocklist.csv	Botnet C2 IP blocklist
ThreatFox	threatfox-api.abuse.ch/api/v1/	7-day IOC feed (IP:port + malware name)
URLhaus	urlhaus.abuse.ch/downloads/csv_recent/	Active malicious URLs

All feeds cached for 6 hours in intel/cache.json. Force refresh:

python intel/threat_feeds.py --force
# or via API:
curl http://127.0.0.1:5000/api/intel/refresh

D. Network Correlation

for conn in psutil.net_connections(kind="inet"):
    if rip in c2_ips:         # FeodoTracker → CRITICAL
    elif rip in ioc_ip_map:   # ThreatFox → CRITICAL
    elif rport in KNOWN_C2_PORTS:   # {4444,1337,31337,...} → suspicious
    elif rport not in (80,443,53,...):  # Unusual port → flag

E. Registry Persistence

Scans 6 autorun locations:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows  (AppInit_DLLs)

---

🔌 REST API

Endpoint	Method	Description
/	GET	Dashboard UI
/api/status	GET	Platform, psutil, YARA, VT key status
/api/scan	GET	SSE stream — real-time scan progress → final results
/api/results	GET	Latest scan results (JSON)
/api/intel/refresh	GET	Force-refresh all threat feeds
/api/hash/<sha256>	GET	Manual hash lookup (local intel + VirusTotal)

Example: Hash Lookup

curl http://127.0.0.1:5000/api/hash/a3b1c2d4e5f6a7b8c9d0e1f2a3b4c5d6

{
  "sha256": "a3b1...",
  "local": {
    "name": "XMRig Miner",
    "signature": "XMRig",
    "tags": ["miner", "xmrig"],
    "first_seen": "2024-01-15",
    "reporter": "abuse_ch"
  },
  "virustotal": {
    "malicious": 58,
    "suspicious": 3,
    "harmless": 0,
    "total": 72
  }
}

Example: SSE Scan Stream

const es = new EventSource('/api/scan');
es.onmessage = e => {
    const data = JSON.parse(e.data);
    if (data.type === 'progress') console.log(data.message, data.percent + '%');
    if (data.type === 'done')     renderResults(data.result);
    if (data.type === 'error')    console.error(data.message);
};

---

🛠️ Requirements

flask>=3.0.0
psutil>=5.9.0
requests>=2.31.0
yara-python>=4.3.0       # strongly recommended

Optional (Windows only, deeper scanning):

pip install wmi pywin32

---

⚠️ Permissions & Safety

Aspect	Detail
Admin required	Run as Administrator on Windows for full registry + process access
Read-only	SilentGuard never writes to registry, kills processes, or modifies files
Remediation	All fix steps shown in UI must be carried out manually by the analyst
Demo mode	On non-Windows (Linux/Mac), shows realistic demo data — no real scanning
Network	Only outbound HTTPS to abuse.ch feeds + optional VirusTotal

---

🗺️ MITRE ATT&CK Coverage

Detections map to the following techniques:

Technique	ID	Detection Method
Process Injection	T1055	YARA shellcode/inject rules
Registry Run Keys	T1547.001	Registry persistence scan
Credential Dumping (Mimikatz)	T1003	YARA gen_mimikatz.yar
Command & Scripting	T1059	Process name + path heuristics
Encrypted Channel (C2)	T1573	FeodoTracker + ThreatFox IP correlation
Scheduled Task	T1053	Registry + process path checks
Cryptomining	T1496	CPU spike heuristic + YARA stratum strings
Ransomware	T1486	YARA gen_ransomware + Neo23x0 rules
Cobalt Strike	T1071	YARA Elastic Cobalt Strike beacon rules

---

📦 Built With

• Flask — backend API + SSE streaming
• psutil — cross-platform process + network enumeration
• yara-python — YARA rule compilation and scanning
• requests — threat feed fetching
• abuse.ch APIs — MalwareBazaar, FeodoTracker, ThreatFox, URLhaus
• Vanilla JS + SSE — real-time dashboard (no framework dependencies)

---

📁 Related Projects

• NanoCore RAT Analysis — Full static/dynamic RE + ML detection of NanoCore RAT v1.2.2.0
• DeepGuard — Real-time deepfake audio detection for VoIP

---

Author

Aryan — M.Tech Cybersecurity & Systems of Networks
Amrita School of Computing, Amritapuri Campus

⚠️ Disclaimer: SilentGuard is for defensive security, education, and research. It performs passive, read-only scanning only. The author is not responsible for misuse.