Cyber Security Incident Response : The Effectiveness of Open-Source Detection Tools in DLL Injection Detection
Article content
Abstract
In response to the growing cyber-attack threat, incident response teams have become a critical component of an organization's cybersecurity strategy. These teams are responsible for detecting, analyzing, and responding to security incidents promptly and effectively. However, detecting code injection attacks can be particularly challenging, as they can be difficult to detect and often go unnoticed until it is too late. Cybersecurity professionals use detection tools to detect and respond to DLL injection attacks that monitor system activity and detect unusual behavior. A large portion of the related literature focuses on the use of commercial DLL injection tools. In contrast, little attention has been paid to the effectiveness of using open-source DLL injection detection tools. Thus, this research project aims to evaluate the effectiveness of three widely used open-source tools, VirusTotal, Sysinternals, and Yara, in detecting DLL injection incidents. This study's findings highlight each tool's strengths and limitations, which in turn enables cybersecurity professionals to make informed decisions when selecting the most suitable tool for DLL injection detection. Furthermore, the study emphasizes the importance of continuous tool development and updates to keep pace with evolving malware techniques and emerging threats. By highlighting the effectiveness of the tools, this research enhances the overall security posture of organizations and individuals, empowering them to mitigate the risks associated with DLL injection attacks proactively. The outcomes of this research project also underscore the significance of leveraging advanced tools to fortify cybersecurity defenses and safeguard critical systems and data.
Keywords
Open-source, DLL injection, VirusTotal, Sysinternal suite, Yara, Incident response
Downloads
References
H. Alnabulsi and R. Islam, “Protecting code injection attacks in intelligent transportation system,” in 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), IEEE, 2019, pp. 799–806.
L. An, M. Castelluccio, and F. Khomh, “An empirical study of dll injection bugs in the firefox ecosystem,”Empir Softwz Eng, vol. 24, pp. 1799–1822, 2019.
W. Matsuda, M. Fujimoto, and T. Mitsunaga, “Detection of malicious tools by monitoring DLL using deep learning,” Journal of Information Processing, vol. 28, pp. 1052–1064, 2020.
A. Ahmad, S. B. Maynard, K. C. Desouza, J. Kotsias, M. T. Whitty, and R. L. Baskerville, “How can organizations develop situation awareness for incident response: A case study of management practice,” Comput Secur, vol. 101, p. 102122, 2021.
B. Miller et al., “Reviewer integration and performance measurement for malware detection,” in Detection of Intrusions and Malware, and Vulnerability Assessment: 13th International Conference, DIMVA 2016, San Sebastián, Spain, July 7-8, 2016, Proceedings 13, Springer, 2016, pp. 122–141.
Satyabrata Jena, “Difference-between-open-source-software-and-commercial-software,” https://www.geeksforgeeks.org/difference-between-open-source-software-and-commercial-software/.
A. Kleymenov and A. Thabet, Mastering Malware Analysis: A malware analyst’s practical guide to combating malicious software, APT, cybercrime, and IoT attacks. Packt Publishing Ltd, 2022.
K. E. Cybersecurity, “The Protection Technologies of Kaspersky Endpoint Security.”
S. J. Yoo, “Study on improving endpoint security technology,” Convergence Security Journal, vol. 18, no. 3, pp. 19–25, 2018.
K. Jochem, “Tag Archives: Applocker”.
S. E. Protection, “Symantec Endpoint Protection 11.0,” Application and Device Control, pp. 1–18, 2008.
S. Srinivasa, J. M. Pedersen, and E. Vasilomanolakis, “Open for hire: attack trends and misconfiguration pitfalls of IoT devices,” in Proceedings of the 21st ACM Internet Measurement Conference, 2021, pp. 195–215.
J. M. Pearce, “Economic savings for scientific free and open source technology: A review,” HardwareX, vol. 8, p. e00139, 2020.
E. Choo, M. Nabeel, R. De Silva, T. Yu, and I. Khalil, “A large-scale study and classification of Virustotal reports on phishing and malware URLs,” arXiv preprint arXiv:2205.13155, 2022.
M. E. Russinovich and A. Margosis, Troubleshooting with the Windows Sysinternals tools. Microsoft Press, 2016.
S. Zhu, Z. Zhang, L. Yang, L. Song, and G. Wang, “Benchmarking label dynamics of virustotal engines,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 2081–2083.
E. Cozzi, M. Graziano, Y. Fratantonio, and D. Balzarotti, “Understanding linux malware,” in 2018 IEEE symposium on security and privacy (SP), IEEE, 2018, pp. 161–175.
M. G. Christopher and K. Raychaudhuri, “A Digital Forensic Approach for Examination and Analysis of Frozen Hard Disk of Virtual Machine.,” International Journal of Cyber-Security and Digital Forensics, vol. 8, no. 4, pp. 262–273, 2019.
C. Avci, B. Tekinerdogan, and C. Catal, “Analyzing the performance of long short‐term memory architectures for malware detection models,” Concurr Comput, vol. 35, no. 6, p. 1, 2023.
E. Ko, J. Kim, Y. Ban, H. Cho, and J. H. Yi, “ACAMA: Deep Learning-Based Detection and Classification of Android Malware Using API-Based Features,” Security and Communication Networks, vol. 2021, pp. 1–12, 2021.
D. Regéciová, D. Kolář, and M. Milkovič, “Pattern Matching in YARA: Improved Aho-Corasick Algorithm,” IEEE Access, vol. 9, pp. 62857–62866, 2021.
N. Naik, P. Jenkins, N. Savage, L. Yang, K. Naik, and J. Song, “Embedding fuzzy rules with YARA rules for performance optimisation of malware analysis,” in 2020 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), IEEE, 2020, pp. 1–7.
P. Black, I. Gondal, A. Bagirov, and M. Moniruzzaman, “Malware variant identification using incremental clustering,” Electronics (Basel), vol. 10, no. 14, p. 1628, 2021.
J. Zhang, M. F. Khan, X. Lin, and Z. Qin, “An optimized positive-unlabeled learning method for detecting a large scale of malware variants,” in 2019 IEEE Conference on Dependable and Secure Computing (DSC), IEEE, 2019, pp. 1–8.
abuse.ch, “MalwareBazaar Database,” https://bazaar.abuse.ch/.
DLL-Files.com, “DLL-files,” https://www.DLL-files.com/ .
M. Halsey and M. Halsey, “Microsoft Sysinternals Suite,” Windows 10 Troubleshooting: Learn to Troubleshoot and Repair Windows 10 Problems Like the Pros Do, pp. 607–636, 2022.
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).