Need help with Venator?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

richiercyrus
172 Stars 29 Forks GNU General Public License v3.0 99 Commits 1 Opened issues

Description

[⛔️ Deprecated] Venator is a python tool used to gather data for proactive detection of malicious activity on macOS devices.

Services available

!
?

Need anything else?

Contributors list

# 128,332
Python
kibana
elastic
dockerh...
77 commits
# 345,905
C++
nuget-p...
Shell
ebpf
1 commit

Venator is no longer supported/maintained, please consider using Venator-Swift instead.

Venator is a python tool used for gathering data for the purpose of proactive macOS detection. Support for High Sierra & Mojave using native macOS python version (2.7.x). Happy Hunting!

Accompanying blog post: https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56

**You may need to specify

/usr/bin/python
at command line instead of "python." if you have alternative versions of python installed.*

S3 upload functionality is live:

python Venator.py -a :::

The script needs root permissions to run, or else you will get the error message below.

Below are the Venator modules and the data each module contains. Once the script is complete, you will be provide a JSON file for futher analysis/ingestion into a SIEM solution. You can search for data by module in the following way within the JSON file:

module:

system_info
: * hostname * kernel * kernel_release

launch_agents
: * label * program * programarguments * signinginfo * hash * executable * plist_hash * path * runAtLoad * hostname

launch_daemons
: * label * program * programarguments * signinginfo * hash * executable * plist_hash * path * runAtLoad * hostname

users
: * users * hostname

safari_extensions
: * extension name * applesigned * developeridentifier * extension_path * hostname

chrome_extensions
: * extensiondirectoryname * extensionupdateurl * extension_name * hostname

chrome_downloads
: * hash * opened * starttime * currentpath * targetpath * state * taburl * tabreferrerurl * siteurl * referrer * mimetype * originalmimetype * totalbytes * dangertype * byextid * byextname

firefox_extensions
: * extensionid * extensionupdateurl * extensionoptionsurl * extensioninstalldate * extensionlastupdated * extensionsourceuri * extensionname * extensiondescription * extensioncreator * extensionhomepageurl * hostname

install_history
: * installdate * displayname * package_identifier * hostname

cron_jobs
: * user * crontab * hostname

emond_rules
: * rule * path * hostname

environment_variables
: * hostname * variable:value

periodic_scripts
: * hostname * periodic_script:"content of script"

current_connections
: * processname * processid * user * TCPUDP * connectionflow * hostname

sip_status
: * sip_status * hostname

gatekeeper_status
: * gatekeeper_status * hostname

login_items
: * hostname * application * executable * application_hash * signature

applications
: * hostname * application * executable * application_hash * signature

event_taps
: * eventTapID * tappingprocessid * tappingprocessname * tappedprocessid * enabled * hostname

bash_history
: * user * bash_commands * hostname

shell_startup
: * user * hostname * shellstartupfilename * shellstartupdata

If the script is run with the '-v' flag, then the hash will be sent to VirusTotal for comparison with their database. This uses their Public API but still requires the use of an API key. You can obtain one from their site, and include it in the Venator command line (or script if appropriate):

sudo VTKEY= /usr/bin/python2.7 Venator.py -v

The calls to VirusTotal do add some running time due to public API key throttling.

When ran with this option a new stanza will appear where appropriate:

virustotal_result
, with possible values
This file is OK.
,
This file has no VirusTotal entry.
or
POSITIVE VT SCAN - See link_to_virustotal_entry
.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.