Genesis

Periodically testing the effectiveness of the defensive security measures that are in place, is required. To combat this, Genesis has been developed. One of the FI-ISAC members is currently using the Genesis framework for repeatedly generating unique test cases.

Periodically testing the effectiveness of the defensive security measures that are in place, is required. Over time, rules or products that used to work, might not function as expected. Creating effective tests is a tedious and time consuming process which also requires in-depth technical knowledge. Even then, most tests are written once and used in all future tests. This might result in the detection of the test, rather than the used technique(s). To combat this, Genesis has been developed.

What is Genesis?

Genesis is a framework that is used to repeatedly generate customised yet unique test cases, based on a given snippet. A snippet is a template that contains meta data and code. The meta data is used when searching through all snippets, whereas the code is used to create “benign malware”. All the snippets are mapped to the MITRE ATT&CK framework. The generated test cases can then be executed on the targeted machine, after which the rules of the in-place security measures should provide alerts regarding the test case.

Multiple languages

Genesis supports multiple languages, is suitable to use on any platform that can run Java 8 EE and NPM, and contains multiple obfuscation profiles to differentiate how much a test case should be obfuscated. Optionally, one can provide user input prior to the obfuscation to further customise the test case.

Versatile platform

Genesis can also serve as an extension of existing platforms such as Cobalt Strike or the Metasploit Framework. This makes the platform more versatile and useful when certain test techniques are already in place.

Documentation

You can find the necessary information here.

Documentation Genesis