CelesTLSH fuzzy hash hunting

Bundle tlsh malware

Find variants of public attack tools by TLSH similarity: Magonia Research's CelesTLSH lookup, the TLSH index, an alert for untrusted binaries close to a tool, and a dashboard. Needs process events with a tlsh field.

From: Magonia Research

Add it

In Bifract, open Exchange, find CelesTLSH fuzzy hash hunting and click Add. Adds each of its items that is not there yet, requirements first.

Contents

Kind	Item	What it is
Lookup	CelesTLSH attack tool hashes	TLSH digests of public attack tools and C2 frameworks, keyed on TLSH_Hash. Use with tlsh(dict="celes_tlsh"), then match() on tlsh_match to bring in Repo_Name and File_Name.
Model	TLSH index	Indexes the distinct digests in the tlsh field, which tlsh() needs. Run a backfill after adding it to cover logs already stored.
Detection	Untrusted Binary Similar to an Attack Tool	An untrusted process within TLSH distance 50 of a public attack tool. Needs Sysmon process events enriched with tlsh and authenticode_trusted, such as Velociraptor's Windows.EventLogs.SysmonProcessEnriched produces.
Dashboard	TLSH Similarity to Attack Tools	Executables close to public attack tools by TLSH distance, by family, host and time.