We Detect Hackers
Automated Compromise Assessments
Nextron @ it-sa Expo Congress 2023
With presentation by CTO Florian Roth at Wed, 11.10.2023, 13:00 – 13:30, Knowledge Forum E
We detect what your Antivirus and EDR misses
Our research focuses on backdoors, hack tools, obfuscated scripts, web shells, and adversary activity that the usual Antivirus and EDR misses to detect.
Automated Compromise Assessments
Checking a system for traces of attacker activity is a time-consuming and laborious task. Our scanner THOR automates compromise assessments and removes the need for tedious work.
Accelerated Forensic Analysis
THOR allows your forensic analysts to focus on the important work. It uses thousands of patterns, YARA and Sigma rules to preprocess forensic images and highlight suspicious elements. It speeds up the analysis process substantially, uncovers malicious activity sooner, saves time and money.
Flexible Deployment
THOR can be used as a stand-alone scanner, on thousands of end systems controlled from an ASGARD Management Center or as a web service in form of THOR Thunderstorm collecting from outdated or exotic operating systems.
Unlimited Possibilities
Our scanners and agents run on Microsoft Windows, Linux, macOS and some IBM AIX variants. However, the collectors for THOR Thunderstorm run on just any operating system. You can scan live systems, disk images or specific forensic evidence like EVTX files, memory dumps or Registry hives.
Everything is On-Prem
Our scanners don’t communicate with a remote system. They can even be used in air-gapped networks. Your confidential data never leaves your network.
Stability has Top Priority
THOR does not require a tangible scanner or agent hooks functions. THOR also does not require the need to install a driver. They can adjust their workload to the system’s resources and don’t interfere with other installed security software like an Antivirus or an EDR.
Highly Customizable
It’s important to be able to scan any malicious threats your organization may face. We make it seamless to add and maintain your own IOCs and rules. THOR accepts many different types of IOCs and ASGARD offers native MISP integration.
Over 500 customers around the globe trust our products including Fortune Global 500 companies, government agencies and NGOs.
Raphael Otto
Head of Cyber Defense Center, Infineon Technologies AG
“I have been given the opportunity to evaluate Nextron’s VALHALLA feed. The handcrafted high quality detections with literally zero false-positive rate are an unmatched capability that does not only enable your detection technologies to stay ahead of the latest advanced threats but also is an extension of your own security team. Given the high quality and value the feed provides I can highly recommend VALHALLA.”
Markus Neis
Threat Intelligence Manager, Swisscom Schweiz AG
Blog
New product announcements and updates, tutorials and security advisories.
Mjolnir Security: Incident Response Training – Dive Deep into Cybersecurity
We're thrilled to announce an exciting collaboration with our esteemed partner, Mjolnir Security. Immerse yourself in their renowned “Blue Team Incident Response Training” taking place from the 23rd to the 26th of October. This four-day intensive program promises a...
Detecting JanelaRAT with Yara and THOR
In the last weeks, we observed an increase in .NET based malware using DLL sideloading. A prominent example is JanelaRAT, a recent campaign targeting Latin American FinTech users. Their initial attack involves a phishing email, mainly in Portuguese language. The user...
How to scan Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core for CVE-2023-35078 Exploitation
In this blog post, we address a critical security concern and explore methods for evaluating potential compromises on devices like Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core using THOR or the free THOR Lite YARA and IOC scanners. Recently, a severe remote...
How to Perform Compromise Assessments on NetScaler / Citrix ADC Appliances Using THOR
In today's interconnected world, cyber adversaries are increasingly targeting and exploiting Internet-facing appliances and devices with unconventional or restricted operating systems. A pressing concern for users is whether it's possible to perform a compromise...