cau

CAU EDR — Certs Are Useless is an open-source malware detection engine developed in Go, providing transparency and reliability in identifying suspicious and malicious files. With a focus on clarity, this engine incorporates six different detection methods, each providing distinct insights into file safety while ensuring that every finding is accompanied by a labeled class and an associated MITRE ATT&CK technique.

Key Features

• Multiple Detectors: CAU employs various detection methodologies:
  • Hash Signatures: Validates known malicious content.
  • YARA: Looks for specific patterns as described by user-defined rules.
  • Heuristics: Identifies files with suspicious capabilities, scoring them based on potential threats.
  • Static Structure Analysis: Analyzes file structures to detect anomalies, utilizing custom parsers for PE and ELF files.
  • Invisible Codepoint Detection: Identifies hidden characters that may indicate malicious intent.
  • Encoded Executable Parsing: Uncovers executables obscured by encoding techniques.
  • Fusion: Combines verdicts from multiple detectors for enhanced decision accuracy.

Usage Example

To initiate a scan using CAU, a simple command can be utilized:

cau scan --dir ./downloads

This scan will read files in the specified directory and report any findings.

Reporting and Output Formats

The results from CAU's scans are provided in various formats, suitable for different use cases, including SARIF for integration with security tools and OCSF for use in security data lakes. The machine-readable reports facilitate integration into Continuous Integration (CI) pipelines, defining explicit exit codes for rapid feedback.

Continuous Improvement

The engine includes an evaluation harness to ensure that every detection change is tested against a measured baseline, maintaining a high standard of reliability. Metrics and findings are documented rigorously to support ongoing development and enhancements.

Documentation

Comprehensive documentation is available, covering installation processes, command-line options, detector functions, output formats, and more, which aids in understanding and utilizing CAU effectively.

Important Reminder

This tool is intended for educational and research purposes only. It is crucial to analyze only the files and systems for which authorization has been obtained, and handling of authentic malware samples should be carried out in secure, isolated environments.