cau

CAU EDR — Certs Are Useless

CAU is a powerful, transparent, open-source malware detection engine developed in Go, designed to enhance security measures by providing accurate detection capabilities. With six distinct detectors, every file is thoroughly analyzed once, and all findings are documented with clearly labeled classes and associated ATT&CK techniques. The output is machine-readable, complete with CI exit codes, and a built-in evaluation harness ensures that any detection modifications are validated against a quantified baseline.

Features

• Multi-Detector Approach: The engine utilizes multiple detection methods, including:
  • Hash Signatures: Identify known malicious content.
  • YARA: Detect patterns based on descriptive rules.
  • Heuristics: Analyze suspicious capabilities for potential threats.
  • Static Structure Analysis: Evaluate file characteristics for hidden content or anomalies.
  • Invisible Codepoints: Uncover hidden code within files.
  • Encoded Executables: Detect executables that are concealed within encoded data.
  • Fusion: Combine insights from various detectors to formulate a cohesive verdict.

Usage Examples

Utilizing CAU is straightforward with command-line tools, such as:

cau scan --dir ./downloads
cau scan ./dist --format sarif --output cau.sarif --fail-on none
cau scan ./build --format json --fail-on heuristic
cau scan ./dist --format ocsf --output findings.json
cau coverage --format navigator --output layer.json
cau rules lint --rules ./signature-base --profile generic

Sample Output

Upon scanning, you may encounter outputs such as:

[!] DETECTED (YARA) — corpus/smoke/malicious/mimikatz_strings.bin
    Verdict   : MALICIOUS
    …
[!] DETECTED (Heuristics) — corpus/smoke/malicious/mimikatz_strings.bin
    Verdict   : SUSPICIOUS
    …

Comprehensive Documentation

CAU provides extensive documentation that covers:

• Installation
• Command-line Reference
• Detector Details
• Output Formats
• Detection Engineering
• Evaluation and Testing

All documentation is easily accessible within the repository, offering insights into maximizing the engine's capabilities effectively.

Project Background and Purpose

Originally a fork of the Astra AV Engine educational series, CAU has evolved into a robust detection system focused on accuracy and measurability in malware analysis. Future developments are planned, with a clear roadmap outlined in PLAN.md.

Important Note

This project is intended for educational and research purposes only. Users should analyze only files and systems they own or are authorized to analyze, ensuring that real malware samples are handled in secure environments.