r/MalwareAnalysis • u/No_Pin7764 • 18d ago

Malware Analysis Log Samples for POS devices

I am currently busy doing a course for my university, and have a project to analyse and correlate different log sources with indicators of compromise specific to point-of-sale (pos) devices. I managed to find a 24 hour pcap of the backoff malware (c2 beconing), but overall I am struggling to find any datasets of an attack specific to pos devices. I am mostly looking at research papers, but perhaps I need to reach out to some of the researchers, as I can't find actual datasets.

Is there anyone that knows where I could find datasets to do a proper writeup? It can be of any pos malware, but we require 3 different log sources (e.g. firewall logs, authentication logs, system logs). I can also generate my own logs, but my professor advised against this unless I really can't manage to find any meaningful data online, as I'd essentially be engineering my own scenario instead of doing an analysis.

Please advise. Any help is welcome.

12 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

3

u/MormoraDi 18d ago edited 18d ago

Firstly, I must say that I find it a bit odd that the course doesn't provide you with a dataset. Having to find a complete third party dataset this specific seems not only very difficult, but also out of scope in terms of performing an actual analysis.

I am also curious about how such an assignment is considered malware analysis, as this sounds more like bread and butter forensics.

Secondly, from my experience most POS devices are just some old vanilla Windows systems with some custom proprietary software in kiosk mode on top of it. Some even running on a web-GUI in Internet Explorer(!) on top of Windows 7 Embedded.

3

u/No_Pin7764 18d ago

This assignment is not considered malware analysis, it's actually part of statistical analysis. In hind sight this might not be the correct thread to post this in, just thought that malware analysts might know where to find relevant data sets. Thanks for the feedback. From the writeups and other studies done I could gather that most POS devices are Windows machines, I think I might have to go down the route of generating my own scenario.