Using Google's Gemini for Cybersecurity Operations
In this post I’ll show how I use Google’s Gemini for cybersecurity operations. AI is a great way to augment operations rather than fully automate the process. Through my prompts I hope you’ll see that I attempt to have a dialogue with the AI rather than totally offload the task. Of course at any time when working with sensative information you must be certain you have permission to put it into a model.
Below is my inital attempt at creating a general standard for case format. In my environment analysts often have different ways of structuring relevent information in their cases. When a reviewer reads the case they it might appear to them to be inadequate just because it is not in a format that they are used to. This is similar to a viewer dismissing a drama movie because they are used to science fiction. Even though both might be good, the science fiction fan dismisses the drama because they are not used to it. At the same time the author and reviewer may genuinlly disagree on what relevent information should go in a case. If so there should be an understanding of what basic components should be in a case.
Later in the conversation I come back to gemini with a first draft. Notice that I’m not asking the AI to complete this task for me. My queries typically consist of a question or I attempt to get an advice from the AI as I am doing here. With the answer I get I can choose to act on the advice or go off an do more research.
Decoding Malware Loaders
I’ve also used gemini to help me convert Visual Basic scripts to their python equivilents. This is useful since I’m more familiar with Python and I don’t have to install an execution environment for Visual Basic since I’m mostly on Unix based machines. The produced scripts typically need a little tweaking, but it’s nothing compared to coding the whole thing from scratch. Using this method I’ve been able to decode multiple novel multistage malware loaders both Visual Basic and Powershell based.
VBS Script translated to Python in order to decode a base64 encoded msi payload
Payloads and then be analyzed via static or dynamic analysis and IOCs collected.
Decoding Bytes
AI easily be used to decode arbitrary collections of shellcode in order to extract IOCs. In the below example I gave Gemini a Python byte array with hope to format it into a hex dump. Alternativly I could have used Python to nativly output the bytes, but you’re in the containment phase of incident response you may want to collect domains as fast as possible.
Prompting Gemini with a byte array
A portion of the hex output that contains a url
I was eventually able to collect a novel C2 domain that was then blocked. You can check the AI’s answer by saving the shellcode as a binary and opening it in a reverse engineering tool like Ghidra.