Noriben wraps Sysinternals Procmon in a Python harness to collect, filter, and summarize runtime malware behavior into readable reports for authorized analysts.
| Tool | Rurik/Noriben — portable Python-based malware analysis sandbox built on Sysinternals Procmon |
| Category | Behavioral malware analysis / dynamic triage |
| Primary Use | Running suspicious samples in a lab VM while Procmon captures process, file, and registry activity, summarized into a text/CSV report for IOC development |
| Safe Use | Intended for malware analysts, forensic researchers, and authorized security teams detonating samples only in isolated lab VMs they control; also used for legitimate software auditing |
| Telemetry Note | Purely defensive: it observes and reports; its output (.pstx/text reports, generalized paths like %AppData%\malware.exe) is itself useful as defanged IOC material for detection engineering |
Noriben occupies a deliberately narrow niche in the malware analysis ecosystem: it is not a full-blown sandbox like Cuckoo, but a Python wrapper around Sysinternals Procmon that turns raw event streams into analyst-readable behavioral reports. The premise is simple — you launch a sample, press a key (or let a timeout fire), and receive a summarized text report of what the process tree actually did. This simplicity is the design philosophy: the README frames it as a "personal, portable" sandbox, an alternative to shipping samples to third-party infrastructure when you want fast local answers in a VM you control.
Architecturally, Noriben is a consumer of Procmon output rather than an instrumentation layer itself. It requires only procmon.exe or procmon64.exe to operate — no agents, no drivers, no network sensors. The tool ships with numerous whitelist entries to suppress baseline OS noise from the capture, which matters because an unfiltered Procmon log is effectively unreadable at scale. Analysts who want tighter captures can supply a custom filter file via the -f/--filter flag, pointing at an alternate .PMC Procmon filter configuration.
What distinguishes Noriben from fire-and-forget sandboxes is its support for manual, interactive detonation. Because it sits and listens while you drive the system, you can feed an application varying command-line options, perform the user interaction it demands, or even walk through it in a debugger while Noriben records system-wide events. The README highlights a scenario of debugging a VM-checking sample — stepping past anti-analysis checks in a debugger while still getting sandbox-equivalent results. That combination of manual control plus automated logging is genuinely uncommon in this tool class.
The README also notes a legitimate non-malware pedigree: in 2013 the Tor Project used Noriben for a public audit of the Tor Browser Bundle, checking for forensic leakage and unexpected behavior in ordinary software. This is worth remembering because the tool is, at its core, a general behavior auditor — malware analysis is simply the noisiest use case. Software supply-chain review and privacy auditing of packaged applications are equally valid deployments in an authorized workflow.
Automation is handled at two levels. First, Noriben itself accepts -t <seconds> to bound collection time and --cmd "path\exe" to specify the sample command line, enabling scripted, snapshot-revert loops. Second, the bundled NoribenSandbox.py frontend orchestrates the whole loop from the host: it spins up a predefined VM and snapshot, copies the sample into the guest, starts Noriben, waits, zips results back to the host, and grabs a VM screenshot. A thoughtful --update option re-copies the newest Noriben from the host so you stop rebuilding snapshots every time the script changes. The README notes the host side currently runs on macOS with a port planned.
Enrichment features are pragmatic rather than exotic. A folder of YARA rule files passed via --yara causes every newly created file to be scanned, with hits surfaced in the output — useful for catching dropped loaders or config blobs mid-execution. A VirusTotal API key placed in a virustotal.api file enables automatic MD5 lookup and result counts for observed files. Known-benign binaries can be suppressed with a hash whitelist built via md5deep and supplied through --hash, with --hashtype selecting MD5, SHA1, or SHA256.
For IOC development, the --generalize option is the standout: absolute paths like C:\Users\malware_user\AppData\Roaming\malware.exe are rewritten to %AppData%\malware.exe, producing detection content that generalizes across victims instead of being tied to your lab username. It defaults to true, which tells you the intended output audience is detection engineers, not just triage analysts. The --process_tree flag adds an ASCII process-creation tree, and --headless keeps results from popping open on the analysis VM — a small but considerate touch for automated pipelines.
Post-processing is first-class: -c/--csv re-analyzes an existing Noriben CSV export and -p/--pml re-processes a saved Procmon PML capture. This means the collection and analysis stages are decoupled — you can capture once in a hardened guest, then iterate on parsing and filtering cheaply on your workstation. For teams building repeatable triage workflows, that split is arguably Noriben's most underrated property, since raw PML files become reusable evidence rather than single-use sessions.
Version context from the usage banner shows v1.7.2 under @bbaskin, with Black Hat Arsenal badges from 2015 and 2023 — an unusually long runway for a tool this small, and a signal that it remains maintained enough to present at recent Arsenals. The repo sits at roughly 1,300 stars, licensed under Apache 2.0, written in Python, with the README openly soliciting documentation contributors. Installation is trivially git clone-based since it is a script collection rather than a package.
Operational caveats are worth stating plainly. Noriben provides containment only insofar as your VM does — it is a sensor, not a jail, so snapshots, isolated networking, and host hygiene remain the analyst's responsibility. Second, hash whitelisting by MD5 is dated given evasion-friendly file tampering, though SHA256 support mitigates. Third, the VirusTotal submission path involves sending file hashes to a third party, which may burn sample confidentiality during sensitive incident response — evaluate that tradeoff before enabling it.
Where Noriben fits in a modern stack is between fully manual Procmon work and heavyweight multi-VM sandboxes. When a sample refuses to behave under automation — demanding interaction, specific CLI flags, debugger-aware tricks — interactive detonation with Noriben logging in the background is often the fastest defensible route to an answer. The output reports, generalized paths, and process trees feed directly into detection rule writing and incident scoping, making it a quiet workhorse for authorized malware analysts, forensic labs, and software auditors alike.
Rurik/Noriben.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.