security
Monitar Malware Detector
Python/Tkinter desktop tool that scans a machine for known indicator-of-compromise file paths and reports a risk level, built for a cybersecurity course case study on a fictional utility-company malware strain.
Role
Developer — cybersecurity coursework (team of 2)
Problem
Simulates the detection side of an incident-response case study: given a set of known malicious file paths, determine whether a machine shows signs of the MONITAR malware. Educational demo, not a production antivirus: it doesn't scan file contents, hashes, or behavior.
Tech Stack
PythonTkinter
How It Works
- 01Configuration.txt lists the files the fictional MONITAR malware would drop on disk: six Windows paths under C:\ProgramData, including DLLs, a monitar.exe, and data files.
- 02The Tkinter menu has two actions: view the configured paths, or run a scan that checks whether each path exists and lists the ones it finds.
- 03The number of matches maps to a risk level: 0 is 'fully protected', 1 to 5 run from very low to very high, and anything above that reports the MONITAR malware.
What I Learned
- –Learned why signature/path-based detection is fragile: it only catches threats you already know the exact indicators for.
- –Because the indicators are hardcoded Windows paths, the scan only means something on Windows. Indicator lists are tied to the platform they were collected on.
- –Simulating both sides of a security case study, the attack scenario and the detector, connected incident-response theory to actual working code.