Implementación de una plataforma de análisis de malware con la herramienta Cuckoo Sandbox para un Security Operations Center Genérico.

Abstract

In recent years we have experienced a fundamental digital transformation. Many people, companies, organizations, and even governments use different technologies and the Internet to improve their processes, sign business-to-business contracts, save or back up their information, provide diverse public and private services, and promote their products, among other activities. This digital transformation was of great importance during the pandemic as many people were forced to use these technologies to perform different actions. Although this digital transformation has grown exponentially lately, it has also caused a proportional increase in cyber-attacks or digital crimes, where organizations or individuals seek to steal information using malware that makes the different systems vulnerable. Therefore, companies and organizations have allotted part of their resources to Computer Security to protect the various systems and avoid victims of these cybercriminals. Based on this, we propose implementing the Cuckoo Sandbox platform that will allow administrators of a generic SOC (Security Operations Center) to run malware samples in a controlled environment. Isolating them from the production environment and allowing them to learn how malware works, apply improvements within their infrastructure and prevent these attacks. This study intends to provide a guide for the installation of this platform, starting with the prerequisites installation for the use of this tool, the usage of a virtual machine to prepare the environment for usage, the platform execution, and finally, how to obtain results after the analysis execution with Cuckoo Sandbox.