ANALYSIS OF THREATLENS SOFTWARE TOOL FOR FORENSIC INVESTIGATION OF MALWARE FILES AND DETECTION OF COMPROMISE INDICATORS
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1396Keywords:
igital forensics, cybersecurity incidents, cyber threats, software security, malware, signature analysis, programming, HTTP traffic, information and communication systems, Python, YARA, MITRE ATT&CKAbstract
This article examines the automation of digital artifact analysis within the contexts of cybersecurity and digital forensics. The work addresses the critical need to rapidly process large volumes of files, network data, and event logs during information security incident investigations. To meet this need, the authors present ThreatLens, a software tool designed for the automated static analysis of potentially malicious digital artifacts without requiring their actual execution. The article outlines the architecture and core functionalities of ThreatLens, including the extraction and validation of indicators of compromise (IoCs); the analysis of PE files, PCAP data, and logs; and the identification of hashes, network addresses, domains, URLs, and other characteristic features. Mechanisms are implemented to detect potentially malicious behavior using MITRE ATT&CK rules, validate indicators against external Threat Intelligence sources, and perform signature-based analysis using YARA. Additionally, the tool supports event timeline generation, threat level assessment, analysis result storage, and the construction of correlation graphs within a web interface, enabling the identification of relationships between detected artifacts and signs of compromise. Particular attention is paid to the secure handling of untrusted data; potentially hazardous operations are isolated in a separate process with execution time limits, while the static nature of the analysis eliminates the need to execute the software under investigation. Finally, the article identifies key limitations of the tool regarding specific network protocol support, the scope of YARA scanning, and digital signature verification capabilities. The proposed directions for further development concern the expansion of supported formats and protocols, the optimization of large-scale data analysis, and the improvement of mechanisms for verifying the obtained results.
Downloads
References
Al-Sada, B., Sadighian, A., & Oligeri, G. (2024). Analysis and characterization of cyber threats leveraging the MITRE ATT&CK database. IEEE Access, 12, 1217–1234. https://doi.org/10.1109/ACCESS.2023.3344680
Chen, S. S., Hwang, R. H., Ali, A., Lin, Y. D., Wei, Y. C., & Pai, T. W. (2024). Improving quality of indicators of compromise using STIX graphs. Computers & Security, 144, 103972. https://doi.org/10.1016/j.cose.2024.103972
Iqbal, S., & Zulkernine, M. (2018). SpyDroid: A framework for employing multiple real-time malware detectors on Android. In 2018 13th International Conference on Malicious and Unwanted Software (MALWARE) (pp. 1–8). IEEE. https://doi.org/10.1109/MALWARE.2018.8659365
Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://csrc.nist.gov/pubs/sp/800/86
MITRE. (n.d.). Enterprise tactics. MITRE ATT&CK. https://attack.mitre.org/tactics/enterprise/
Murali, R., Ravi, A., & Agarwal, H. (2020). A malware variant resistant to traditional analysis techniques. In 2020 International Conference on Emerging Trends in Computer Technologies and Engineering (ic-ETITE) (pp. 1–7). IEEE. https://doi.org/10.1109/icETITE47903.2020.264
Paine, K., Whitehouse, O., Sellwood, J., & Shaw, A. (2023). Indicators of compromise (IoCs) and their role in attack defence (RFC 9424). Internet Engineering Task Force. https://www.rfc-editor.org/info/rfc9424
SLIFER: Investigating performance and robustness of malware detection pipelines. (2024). Computers & Security. https://www.sciencedirect.com/science/article/pii/S0167404824005704
Sun, H., Shu, H., Kang, F., Zhao, Y., & Huang, Y. (2024). Malware2ATT&CK: A sophisticated model for mapping malware to ATT&CK techniques. Computers & Security, 140, 103772. https://doi.org/10.1016/j.cose.2024.103772
Tang, H., Lin, D., Li, W., Zhang, W., & Zhao, J. (2024). Cyber threat indicators extraction based on contextual knowledge prompt. Computer Networks, 254, 110839. https://doi.org/10.1016/j.comnet.2024.110839
YARA. (n.d.). Writing YARA rules. https://yara.readthedocs.io/en/stable/writingrules.html
Havrysh, B. M., Tymchenko, O. V., Borzov, Y. O., & Kobevko, A. T. (2022). Klasyfikatsiia shkidlyvoho prohramnoho zabezpechennia ta osnovni metody zakhystu [Classification of malicious software and main protection methods]. Kompiuterni tekhnolohii drukarstva, 2(48), 142–154.
Polotai, O. I. (2023). Vykorystannia kompiuternoi kryminalistyky dlia zabezpechennia efektyvnoho rozsliduvannia intsydentiv informatsiinoi ta kiberbezpeky [Use of computer forensics to ensure effective investigation of information and cybersecurity incidents]. Visnyk Lvivskoho derzhavnoho universytetu bezpeky zhyzniediialnosti, 28, 73–80.
Polotai, O. I., & Kasprivskyi, D. V. (2025). Syhnaturnyi analiz shkidlyvoho prohramnoho kodu v systemakh zakhystu informatsiino-komunikatsiinykh merezh [Signature analysis of malicious software code in information and communication network protection systems]. In Science and society: Interdisciplinary horizons (pp. 284–289). https://eu-conf.com/en/events/science-and-society-interdisciplinary-horizons/
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Орест Полотай, Артур Ткаченко, Наталія Кухарська, Дмитро Каспрівський
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
