guardicore / guardicore/monkey

Spoof malicious traffic to test network defenses

Open
#827 1 comment 0 reactions 0 assignees View on GitHub
Complexity: Medium Feature Impact: Medium
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
Improve the coverage of ZT tests.

**Describe the solution you'd like**
Monkeys should access a random subset of domains which are known to be malicious, such as PhishTank. If it manages to access the domains, fail the test.

We should store a list of 100 domains or so (not plaintext!) and choose 3 at random so the test isn't 100% predictable (like real malware :) )

This can be a simple PBA with a relevant PBA processor in `post_breach.py`.

ZT info:
- Pillars: Networks, Visibility
- Principle: Analyze network traffic for malicious activity
- Test: Monkey tried to communicate with known malicious domains

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.