The new THOR-util version 1.2.4 supports the encryption of your custom signatures so that you can deploy your own IOC files and YARA rules in an encrypted form.
We use a public key in the utilities to encrypt the files for our scanners so that admins, Antivirus engines and attackers won’t be able to read the contents of the files.
The feature is also available in SPARK Core, our free scanner.
After encryption, place the encrypted IOC files in the “./custom-signatures” directory and the encrypted YARA rules in the “./custom-signatures/yara” directory.
The use of the function is simple. Just point it to a file, a list of files or use wildcards to select a set of files for encryption. The extension of the output file depends on the extension of the input file.
- IOC Files: .txt > .dat
- YARA Rules: .yar > .yas
- Sigma Rules: .yml > .yms
Examples:
thor-util.exe encrypt case44.yar thor-util.exe encrypt case44-hashes.txt thor-util.exe encrypt case44-hashes.txt case44.yar thor-util.exe encrypt case44.*
You can use the “upgrade” feature in both tools to get the newest version of the utility.
thor-util upgrade
