YALIH
A low interaction client honeypot that detects malicious websites using signature, anomaly and pattern matching techniques with automated URL collection and JavaScript analysis capabilities.
YALIH
A low interaction client honeypot that detects malicious websites using signature, anomaly and pattern matching techniques with automated URL collection and JavaScript analysis capabilities.
YALIH Description
YALIH YALIH (Yet Another Low Interaction Honeyclient) is a low interaction client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques. The tool collects suspicious URLs from multiple sources including malicious website databases, Bing API searches, and email inboxes through POP3 and IMAP protocols. It performs JavaScript extraction, de-obfuscation and de-minification of scripts embedded within websites. YALIH YALIH includes referrer emulation and redirection handling capabilities, along with cookies and session management. The system emulates browsers, browser agents and operating systems to appear as legitimate clients. It supports proxy capabilities to detect geo-location and IP cloaking attacks. For detection, the tool uses signature-based detection through ClamAV antivirus database integration and anomaly/pattern matching detection through Yara rules. It includes automated Yara signature generation functionality to create custom detection rules based on observed malicious patterns.
YALIH FAQ
Common questions about YALIH including features, pricing, alternatives, and user reviews.
YALIH is A low interaction client honeypot that detects malicious websites using signature, anomaly and pattern matching techniques with automated URL collection and JavaScript analysis capabilities.. It is a Security Operations solution designed to help security teams with YARA, Signature, Pattern Matching.
