Duqu Check Forensics Module

[threatagent]

This module performs registry checks related to Duqu malware based on Symantec report

Source: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

[hdm]

Instead of splitting the string based on commas, please just set this to an array.

• query = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"CFID",'
• query += 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CFID,'
• query += 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JmiNET3,'
• query += 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JmiNET3\FILTER'

•            match = 0
  

•            print_status("Searching registry on #{sysinfo['Computer']} for Duqu attributes.")
  

•            keys = query.split(/,/)
  

This should become:

queries = [
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"CFID"',
[ .. ]
]

and queries.each do |k| [ .. ]