Cybersecurity Research
Framework

Purpose and Scope

This framework was built to understand the techniques used by advanced persistent threats (APTs) and malware. By implementing these techniques in a controlled, educational environment, security researchers can:

• Understand how modern malware evades detection
• Develop better defensive strategies and detection rules
• Train incident response teams on real-world attack patterns
• Test endpoint detection and response (EDR) systems

Architecture Overview

The framework follows a modular client-server architecture with clear separation between the monitoring payload and the administration interface.

Server (Target Simulation)

server_modules/
├── api_routes.py              # Flask REST API endpoints
├── monitoring.py              # System monitoring core
├── advanced_c2.py             # Multi-channel C2 (DNS, ICMP, dead drops)
├── anti_debug.py              # Debugger detection techniques
├── anti_vm.py                 # Virtualization detection
├── evasion.py                 # String obfuscation, control flow
├── persistence_manager.py     # Registry, service, WMI persistence
├── surveillance_suite.py      # Audio/video monitoring
└── encryption.py              # AES-256 payload encryption

Client (Administration Interface)

client_modules/
├── gui.py                     # Tkinter administration GUI
├── api_client.py              # REST API wrapper
├── server_tab.py              # Per-server management view
└── callback_listener.py       # Reverse connection handler

Technical Implementations

Multi-Channel Command & Control

Educational implementation of covert communication channels used by real APTs:

• DNS Tunneling: Data exfiltration via DNS TXT records
• ICMP Covert Channels: Command transmission via ping packets
• Dead Drops: Pastebin, GitHub Gists for config distribution

Evasion Techniques (Educational)

Implemented to understand how malware avoids analysis:

• Debugger detection via Win32 APIs and timing checks
• VM/sandbox detection via hardware fingerprinting
• String obfuscation with XOR encryption
• Process injection techniques for study

Persistence Mechanisms

Multiple techniques for surviving reboots, implemented to test detection:

• Registry run keys and startup folders
• Windows Service creation
• WMI event subscription
• Scheduled task creation

Build System

Uses Nuitka to compile Python to C, producing native executables:

• Faster execution than standard Python
• No Python runtime dependencies
• Single-file distribution option
• Console or no-console builds

Security Considerations

Built with multiple safeguards for responsible use:

• API key authentication required for all endpoints
• Configurable data retention policies
• Local network-only operation by default
• Educational checks don't block execution (for research)

What I Learned

Building this framework provided deep insight into how modern malware operates. Understanding these techniques is essential for developing effective defenses. The complexity of multi-channel C2, the sophistication of evasion techniques, and the persistence of modern threats all became clear through implementation.

Applications

• Security Research: Understanding APT techniques
• Red Team Operations: Authorized penetration testing
• EDR Testing: Evaluating endpoint detection systems
• Training: Incident response team preparation