Tag: MITRE ATT&CK

Unpacking ATT&CK With MalChela v4.4

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage, yara

I came home from ATT&CKcon with a full notebook and a head full of technique IDs. So, fair warning: this release is on a bit of a MITRE kick. But it’s not the only thing in here. v4.4 has three headliners: a brand-new unpacker, ATT&CK mapping across the whole toolkit, and a move to YARA-X that makes installing MalChela a lot less painful.

Unpack

This one came straight out of conversations at the conference.

@dwmetz How can I extract the details strings from packed malware sample. Can Malchela support malware unpacked feature?

Up to now the honest answer was “go get another tool.” Not anymore.

Unpack detects packers, installers, and bundlers in PE, ELF, and Mach-O files and pulls out the payload statically. It never runs the sample. Every call it makes comes with the evidence behind it, and anything it recovers goes right back through Unpack again, so a dropper inside an installer inside a UPX stub comes out as a layer tree instead of just the outer shell.

  • UPX, including the mangled headers Mirai and friends use to make upx -d give up. Unpack repairs a working copy and records every byte it touched.
  • PyInstaller, and then it keeps going into the Python bytecode itself (3.7 through 3.14), peeling off the obfuscation wrappers stealers love: xz, zlib, base64, rot13, the works. The strings land in mStrings automatically.
  • .NET / Costura resources, NSIS, Inno Setup, fat Mach-O, overlays, and executables embedded in other executables.

Point Analyze at a packed sample and Unpack kicks in on its own. Everything it recovers gets the full MalChela treatment. Running a LunaGrabber build through it was a good test: an obfuscated entry script three layers deep, and out came the Discord webhook it exfiltrates to.

MITRE All the Things

Between Unpack, the Mac tools, File Miner, and Analyze, a single run can turn up ATT&CK findings from a dozen files and half a dozen tools. Reading those as a list gets old fast. So now every Analyze run plots them on the Enterprise matrix.

  • Tiles are shaded by how many files hit them. Click one and you get the evidence: which rule, which tool, which file, and the strings that matched.
  • Open the matrix for any saved case, and it pulls in every Analyze run and every standalone tool report in that case. Older cases work too.
  • Every run also saves an ATT&CK Navigator layer, so you can take it straight into Navigator.
  • Everything is on ATT&CK v20: Stealth and Defense Impairment instead of the retired Defense Evasion, and revoked techniques remapped.
  • Click a technique ID in mStrings and the built-in MITRE Lookup opens right there. (Cmd/Ctrl-click still takes you to attack.mitre.org.)

YARA-X

If you’ve ever installed MalChela on a Mac, you know the dance: brew install yara, then export YARA_LIBRARY_PATH, then BINDGEN_EXTRA_CLANG_ARGS, then hope. That’s all gone. Every MalChela tool now runs on YARA-X, VirusTotal’s Rust rewrite of YARA, compiled right in. No libyara, no bindgen, no OpenSSL. On Linux the prerequisites are now build-essential and pkg-config. On a Mac it’s the Xcode command line tools.

It also clears the biggest roadblock to running MalChela natively on Windows. WSL2 is still the supported route for now, but native Windows testing is next on my list.

A huge thank-you to Daniel Iwugo (@elementmerc), who did the groundwork on the new YARA backend and closed the gaps between it and libyara. This is what open source is supposed to look like.

YARA Scan

With the engine built in, it would have been silly not to expose it. YARA Scan is a new tool for running your own rules against a file or folder, and it speaks the same language as VirusTotal’s yr scan: same flags, same output. I tested it side by side with yr on the full signature-base rule set and got identical results. It saves reports to your case, and there’s a simplified panel in the web interface. For the deeper yr features like compiled rules and module data, the YARA-X integration is still there.

IP Reputation and GreyNoise

Threat Intel Query now looks up IP addresses on VirusTotal, AlienVault OTX, and, new in this release, GreyNoise. There’s a new IP tab, and defanged input is fine. The part I like best: an IP being “found” doesn’t mean much on its own, since 8.8.8.8 is in every source there is. So instead of FOUND, each source tells you what it actually concluded: flagged, clean, a known benign service, or a scanner. Analyze runs the same lookups on the IPs it finds.

mStrings got smarter about IPs too. When dozens of addresses are stored together, like a sandbox blocklist or a C2 pool, they’re reported as one list instead of fifty separate “C2” hits.

Odds and Ends

  • The Analyze summary now follows the structure of Lenny Zeltser’s Malware Analysis Report template, and the template is built into the MCP plugin, so Claude can write the full report and save it to your case.
  • mStrings recognizes encoded string tables. AMOS keeps its whole AppleScript as about 1,900 encoded strings; now you get one clear finding instead of a wall of matches.
  • The API Keys panel has a slot for GreyNoise, and At a Glance counts all 21 tools.
  • The docs and the PDF user guide are up to date, with new pages for Unpack and YARA Scan.
Grab the latest MalChela release
Read the Docs

Enhance Threat Hunting with MITRE Lookup in MalChela 3.0.2

DFIR, Forensics, Malware, MITRE ATT&CK, Rust

Understanding adversary behavior is core to modern forensics and threat hunting. With the release of MalChela 3.0.2, I’ve added a new tool to your investigative belt: MITRE Lookup — a fast, offline way to search the MITRE ATT&CK framework directly from your MalChela workspace.

Whether you’re triaging suspicious strings, analyzing IOCs, or pivoting off YARA hits, MalChela can now help you decode tactics, techniques, and procedures without ever leaving your terminal or GUI. MITRE Lookup is powered by a local JSON snapshot of the ATT&CK framework (Enterprise Matrix), parsed at runtime with support for fuzzy searching and clean terminal formatting. No internet required.

What It Does

The MITRE_lookup tool lets you:

  • Search by Technique ID (e.g., T1027, T1566.001)
  • Search by topic or keyword (e.g., ‘RDP’, ‘Wizard Spider’)
  • Get tactic category, platforms, and detection guidance
  • Optionally include expanded content with the –full flag
  • Use from the CLI, MalChela launcher, or GUI modal

Example:

$ ./target/release/MITRE_lookup -- T1059.003

T1059.003 - Windows Command Shell

Tactic(s): execution

Platforms: Windows

Detection: Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent...
MITRE Lookup (CLI)

GUI Integration

  • Select MITRE Lookup in the left-hand Toolbox menu
  • Use the input field at the top of the modal to enter a keyword or technique ID (e.g., `T1059` or `registry`)
  • Use the “Full” checkbox for un-truncated output
  • “Save to Case” option

Saving for Later

You can save MITRE Lookup results directly from the GUI, either as a standalone markdown file to a designated folder, or into the active Case Notes panel for later reference. This makes it easy to preserve investigative context, cite specific TTPs in reports, or build a threat narrative across multiple tools. The saved output uses clean Markdown formatting — readable in any editor or compatible with case management platforms. This feature is already live in v3.0.2 and will evolve further with upcoming case linkage support.

Markdown view of a MITRE_lookup report

Why MITRE ATT&CK in MalChela?

MalChela already focuses on contextual forensics — understanding not just what an artifact is, but why it matters. By embedding MITRE ATT&CK into your daily toolchain:

  • You reduce pivot fatigue from switching between tools/web tabs
  • You boost investigation speed during triage and reporting
  • You enable a more threat-informed analysis process

Whether you’re tagging findings, crafting YARA rules, or writing case notes, the MITRE integration helps turn technical output into meaningful insight — all from within the MalChela environment.