malefic/config_lint.json at master · godfather9921/malefic · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
{
  "type": "object",
  "properties": {
    "basic": {
      "type": "object",
      "properties": {
        "targets": {
          "type": "array",
          "items": { "type": "string" }
        },
        "protocol" : { "type": "string" },
        "tls": {
          "type": "object",
          "properties": {
            "enable": { "type": "boolean" },
            "version": {
              "type": "string",
              "enum": ["auto", "1.2", "1.3"]
            },
            "cert_verification": {
              "type": "string",
              "enum": ["none", "system"]
            },
            "sni": { "type": "string" },
            "mtls": {
              "type": "object",
              "properties": {
                "enable": { "type": "boolean" },
                "cert_path": { "type": "string" },
                "key_path": { "type": "string" }
              },
              "required": ["enable"]
            }
          },
          "required": ["enable"]
        },
        "interval": { "type": "integer" },
        "jitter": { "type": "number" }
      },
      "required": ["targets", "interval", "protocol", "tls", "jitter"]
    },
    "implants": {
      "type": "object",
      "properties": {
        "mod": { "type": "string" },
        "register_info": { "type": "boolean"},
        "modules": {
          "type": "array",
          "items": { "type": "string" }
        },
        "apis": {
          "type": "object",
          "properties": {
            "level": { "type": "string" },
            "priority": {
              "type": "object",
              "properties": {
                "normal": {
                  "type": "object",
                  "properties": {
                    "enable": { "type": "boolean" },
                    "type": {"type": "string"}
                  },
                  "required": ["enable", "type"]
                },
                "dynamic": {
                  "type": "object",
                  "properties": {
                    "enable": { "type": "boolean" },
                    "type": {"type": "string"}
                  },
                  "required": ["enable", "type"]
                },
                "syscalls": {
                  "type": "object",
                  "properties": {
                    "enable": { "type": "boolean" },
                    "type": {"type": "string"}
                  },
                  "required": ["enable", "type"]
                }
              },
              "required": ["normal", "dynamic", "syscalls"]
            }
          },
          "required": ["level", "priority"]
        },
        "alloctor": {
          "type":"object",
          "properties": {
            "inprocess": {"type": "string"},
            "crossprocess": {"type": "string"}
          },
          "required": ["inprocess", "crossprocess"]
        },
        "sleep_mask": { "type": "boolean" },
        "sacrifice_process": { "type": "boolean" },
        "fork_and_run": { "type": "boolean" },
        "hook_exit": { "type": "boolean" },
        "thread_stack_spoofer": { "type": "boolean" },
        "pe_signature_modify": {
          "type": "object",
          "properties": {
            "feature": { "type": "boolean" },
            "modify": {
              "type": "object",
              "properties": {
                "magic": { "type": "string" },
                "signature": { "type": "string" }
              },
              "required": ["magic", "signature"]
            }
          },
          "required": ["feature", "modify"]
        }
      },
      "required": ["mod","modules", "apis", "alloctor", "sleep_mask", "sacrifice_process", "fork_and_run", "hook_exit", "thread_stack_spoofer", "pe_signature_modify"]
    }
  },
  "required": ["basic", "implants"]
}