ASGARD 2.14 Release

Nov 3, 2022 | ASGARD Management Center, Newsletter

We’ve just released the new ASGARD Management Center version 2.14 with important new features. This blog posts lists the most important changes in dedicated chapters. The whole change log can be found at the end of the article. 

Broker Network

The Broker Network allows you to proxy connections to an ASGARD through a so called Broker.

The Broker is a hardened connection proxy that brokers connections to an ASGARD Management Center. Brokers can be exposed to the Internet and allow users to roam between the corporate network and their home network without the need for a permanent VPN connection. They can also load balance connections. 

Two more components are required to maintain a Broker Network: a Gatekeeper and a Lobby.

The Gatekeeper is an application layer firewall that filters malformed or unverifiable requests. The Lobby is a dedicated system to manage and accept new request from yet unverified agents.

The use of the new Broker Network and its components is optional and requires a so-called “Broker License”. Please contact us for more details.

ASGARD Query Language

The new ASGARD query language allows to filter the list of assets based on complex conditions.

It can also be used to select targets for scans or other tasks. 

Advanced Target Selection

Currently, the target selection only allows the selection of target groups based on their label. All target groups are combined with a logical OR. 

The new target selection allows you to include and exclude groups of assets based on their tags. 

E.g., you can now create a job that runs on all systems with the tag “linux” and exclude all systems with the tag “munich”. You can also combine them with a logical AND and instruct ASGARD to run tasks only on systems that have e.g. the labels “windows” AND “berlin”.

The result of this change is that you no longer need to label everything you want to select as target.

New Maintenance Tasks

New predefined tasks allow you to reconfigure or move an agent from one ASGARD Management Center to another one. 

 

Other Important Changes and Improvements

  • Repeated installation of ASGARD agents will not cause duplicate assets
  • Manual deletion of assets from Asset View
  • Multiple UI improvements
  • The new ASGARD agent will not send his agent log via syslog by default anymore. This has to be enabled individually.

Full Change Log

  • Feature: Broker Network support
  • Feature: Search and select assets with queries, e.g. ‘hostname ends with “-dev” OR labels = “dev”‘
  • Feature: Optionally create group tasks with an asset query instead of labels
  • Feature: The agent config can now be maintained from ASGARD, e.g. change proxy settings
  • Feature: Move agent to a different ASGARD
  • Feature: Automatically resume THOR scans that have been terminated due to shutdown signals (e.g. on reboot)
  • Feature: Added a lot new ASGARD features to Master ASGARD, e.g. manage and download agent installers, manage Broker Network
  • Feature: Allows to delete assets
  • Feature: Delete agent installers
  • Feature: Added diagnostic checks to diagnostic download packs
  • Feature: Support unix filepath format in playbooks for Windows targets
  • Feature: Detect assets that run with same key material, e.g. cloned assets
  • Feature: Forward THOR and Aurora events via rsyslog
  • Feature: Migrate key material from old agent config on agent re-installation
  • Feature: Added more columns in some tables, e.g. ‘creator’ in service configurations or ‘active since’ in services
  • Feature: Download ASGARD users as CSV
  • Feature: Set description for remote consoles
  • Feature: New default playbook “Collect Agent Log” (requires an agent update)
  • Feature: Bulk task / scan creation
  • Change: Require min. TLS 1.3 for all agent connections. To disable min. TLS 1.3, set “LegacyTLS=1” in the ASGARD config file.
  • Change: Disable “Add and activate” button for “Add group task”, if “Scheduled start” is set
  • Change: Allow “–nohtml” flag for THOR
  • Change: Set scan status to error if THOR scan result does not contain ‘THOR scan finished’ message
  • Change: Collect stdout/stderr at the end of each playbook step instead of streaming it directly to ASGARD
  • Change: Automatically set THOR’s max runtime to unlimited and removed THOR’s max runtime argument from THOR flag list
  • Change: Ignore deprecated sigma rules
  • Change: Improved compression level of some generated zip files
  • Change: Allow stop of group tasks without starting it
  • Change: Improved diagnostics for synchronization with Analysis Cockpit
  • Change: Disabled syslog debug log on agents by default, added option to agent installer to enable syslog
  • Change: Added key usage and SAN to self-signed TLS certificate for UI on installation
  • Bugfix: Security fixes
  • Bugfix: Fixed missing ‘Default response mode’ in Sigma ruleset details
  • Bugfix: Fixed some missing Aurora flags
  • Bugfix: Fixed non-working save button for global Sigma false positive filter list
  • Bugfix: Fixed NaN when removing the score of an IOC
  • Bugfix: Fixed a bug in event caching in offline mode of Aurora Agent and LogWatcher
  • Bugfix: Fixed ‘Windows 11’ detected as ‘Windows 10’
  • Bugfix: Fixed missing LastLogon date in local users table
  • Bugfix: Disable deletion of the own user
  • Bugfix: Added “x86_64” in addition to “amd64” for agent installer rpm packages to support older yum/rpm
  • Bugfix: Fixed wrong YARA rule count after uploading YARA rules
  • Bugfix: Fixed “in a few seconds” last seen timestamps that have been caused by either a wrong server or browser clock
  • Bugfix: Removed some Aurora and Sigma error messages in ASGARD log after fresh installation
  • Bugfix: Removed a race condition between automatic and manual update checks that may cause corrupt product version numbers
  • Bugfix: Fixed missing “enabled/disabled service” history entries on ASGARDs that are connected to a Master ASGARD
  • Bugfix: Fixed corrupt network interfaces search in asset table for new assets that had no interrogate job yet
  • Bugfix: Fixed a bug in motd config that causes some error messages after a fresh installation
  • Bugfix: Removed c2 file name prefix from some compiled custom signatures
  • Bugfix: Fixed non-working obfuscated agent for AIX

Mjolnir Security: Blue Team Incident Response Training

Aug 29, 2022 | Newsletter, Nextron, Partner, THOR Lite

Our partner Mjolnir Security offers a training named “Blue Team Incident Response Training” from 19th of September to 23rd of September.

It’s 3,5 hours a day, starting 4:00 pm and finishing 7:30 pm Eastern time. Each session will be recorded, so you’ll also be able to catch up on anything you’ve missed.

On day 4 you’ll learn how to write YARA rules and use the full potential of the THOR scanner together with ASGARD Management Center, our centralized management platform for easy scan management, incident response features and much more.

An analysis of the findings with our Analysis Cockpit is demonstrated as well as part of the training.

It’s a great opportunity to see a combination of our enterprise grade tools working seamlessly together, allowing you to get hands-on experience and a clear picture of how a full deployment would look like.

As a THOR Lite subscriber you can get a 30% discount on the training. In order to benefit from this discount, use the following discount code on checkout: NextronThorLite

Or use the direct link: https://www.eventbrite.ca/e/393153361287/?discount=NextronThorLite

Existing Nextron customers can even get a 50% discount. Please contact us for details.
The training is free for law enforcement and government agencies. We provide a contact method for said agencies to benefit from this discount.

Registration URL: https://www.eventbrite.ca/e/blue-team-incident-response-training-tickets-393153361287

Training Organizer: training@mjolnirsecurity.com

New Analysis Cockpit 3.5

Jul 29, 2022 | ASGARD Analysis Cockpit, Newsletter, Nextron

New Baselining Views

Over the course of the last 18 months we reviewed most of our detections regarding their success in real world scenarios. In this context “success” means, that the detection uncovered malicious activity in the wild and at the same time had a low anomaly and false positive rate. Additionally we also consider a detection to be successful that caused little or no false positives or anomalies.

All this lead to two new views within the Cockpit’s Baselining section: “Compromise Assessment Mode” and “Deep Inspection Mode”.

“Compromise Assessment Mode” includes only matches of the highly successful rules. The second mode is the “Deep Inspection Mode”. This view is basically how it used to be (the old default view). It shows all Alerts and Warnings unless they are already part of an existing case.

This new “Compromise Assessment Mode” dramatically reduces our customer’s baselining effort.

In our tests we noticed a decrease of events in the Baselining section of more than 90%. We believe that especially entities that follow our “Continuous Compromise Assessment” approach should switch into this new mode. We’ve also challenged the new mode with the post exploitation tools and techniques found in the context of HAFNIUM / Exchange exploitations in March 2021 and covered almost every aspect of the attacks in the new view.

Asset Labels

Another exciting new feature that comes with Analysis Cockpit version 3.5 is an event filter based on asset labels. This was requested by many of our customers and partners, but until now we never found a way to deliver this feature without negatively affecting the Cockpit’s performance. We solved this now by allowing two limitations to this feature. It doesn’t work for events that existed prior to the update. Secondly an event always remains linked to the asset label it had at the time the event occurred. Changing an assets label will only affect events from scans that take place after the label change.

Other Changes

  • Hidden static filters in certain views
  • Minor bugfixes and stability improvements

Release

The new Analysis Cockpit will be released in the 2nd half of August. Interested customers can get a guide to use the “preprod” version of Analysis Cockpit 3.5. 

Follina CVE-2022-30190 Detection with THOR and Aurora

Jun 13, 2022 | Aurora, Newsletter, THOR

The Follina 0day vulnerability (CVE-2022-30190) in Microsoft Windows is actively exploited in-the-wild and highly critical. This blog posts lists some important web resources and the signatures that detect exploitation attempts.

Kevin Beaumont's Blog Post

Kevin’s post contains links to tweets of researchers that discovered the 0day exploit, information on the timeline, and mitigations

Huntress Labs Blog Post

Explains the exploit in more detail

Counter Measures

Recommended counter measures by Benjamin Deplhy

Signatures Detecting Follina / CVE-2022-30190 Attacks

Check for matches with the following rules:

YARA

Rules shared in the public signature-base and used in THOR and THOR Lite

Only available in THOR

Sigma

Public Sigma rules used in Aurora, THOR and Aurora Lite

Private Sigma rules only available in Aurora

  • Sdiagnhost Loading System.Management.Automation.dll – 1a4a0e9c-e47d-492c-800f-545f83fac88a
  • Sdiagnhost Calling Suspicious Descendant Process – 8655fa4b-e956-4ed4-b20d-151dfd8c802d

ASGARD v2.13 Release

Apr 13, 2022 | ASGARD Management Center, Newsletter

Over the last 4 months, we’ve worked on many new UX improvements and the integration of our endpoint agent Aurora. Today, we are glad to announce the release of ASGARD version 2.13. 

UX Improvements

We’ve reworked many sections and dialogues with user experience (UX) in mind. 

Overall, we’ve made more than 260 changes, reworked complete sections and dialogues and added completely new functions like the new “diagnostics”. 

Some of highlights:

  • Each THOR scan now shows a progress bar that doesn’t only show the state of completion but also the current module and element, the module progress and the amount of time spent on this module. This can help you to identify bottlenecks, issues or elements that should better be excluded from the scan.
  • All tables now have an option for an auto-refresh, which can be set per user and table (persistent setting by user)
  • The new diagnostics section helps you to quickly identify connectivity or configuration issues
  • Export and Import of Scan Templates
  • Reworked THOR download section, which allows to generate links for the “latest available version” and shows an information on the API endpoint usage
  • Improved agent installer repackaging options (e.g. repack all outdated installers)
  • Many dialogues with additional error handling of common user errors

Some of the planned UX improvements are still on the roadmap and will be part of the next update. These include: 

  • More flexible group scan target selection (combine labels with AND instead of OR, filter selection for labels to exclude)
  • Maintenance section in which users can define clean-up rules for old data (remove old assets, automatically remove old log data etc.)

 

 

Scan Progress Bar (Single Scan)

Scan Progress Bar (Group Scan; Collapsed Info)

Auto Refresh Options

System Diagnostics

Background Load Indicators (green line)

Export & Import of Scan Templates

Reworked THOR Download Section (generate link for the latest version, information about the use of the tokens)

Improved Agent Installer Repackaging Options

Aurora Agent Support

This version allows the deployment and management of our Sigma-based endpoint agent.

You can find information about Aurora here.

ASGARD Management Center allows you to:

  • Manage rules that you want to use
  • Add false positive filters to rules
  • Define response actions for certain rules
  • Manage updates on these rules
  • Group rules into rule sets
  • Use rule sets in an Aurora configurations
  • Assign configurations to groups of end systems
  • Put all response actions in a configuration into simulation mode
  • Put single response actions in simulation mode
  • Manage rules that have been in simulation mode for a certain time
  • Apply so-called response sets (groups of response actions provided by Nextron) to your rule set
  • Apply your IOCs or IOCs retrieved from a MISP instance with Aurora

Aurora Agents (Deployed)

Sigma Rule Set Management

Aurora Agent Configurations

More changes in this release

  • AIX support (beta users only)
  • Collect THOR log as JSON (optional)
  • New section “Playbook Files” to manage all files and tools used in playbooks
  • License expiration warning messages
  • many more – see the changelog for all details

Upgrade

ASGARD Management Center customers upgrade their instances in “Updates > Management Center”. 
Important: Make sure to upgrade Master ASGARD instances before upgrading the connected ASGARDs. 

Aurora Lite Agent v1.0 Release

Apr 4, 2022 | Aurora, Newsletter, Security Monitoring, Video

After almost half a year of development, we are pleased to announce the release of our free version of the Aurora Agent named Aurora Lite.

The Aurora agent is a Sigma-based endpoint agent that offers maximum transparency, flexibility, and confidentiality. It doesn’t require an additional kernel driver but uses the native Event Tracing for Windows (ETW). Other detection modules like the “Cobalt Strike Beaconing Detector” or the “LSASS Dump Detector” provide detection capabilities that exceed the scope of pure Sigma matching. 

Aurora Lite is a limited but free version of the endpoint agent. It lacks some features, has no additional detection modules, and cannot be used with the comfortable ruleset and configuration management in ASGARD Management Center. The complete list of limitations can be found here.

Regardless of these limitations, we believe that even the free version can compete with other commercial endpoint agents and provides similar detection coverage. 

Captured Pre-Release Web Session

Slide Deck

The slide deck shown in the recorded web session can be found here.

Slides 8 to 18 contain a quick start guide.

Online Manual

The Aurora Agent online manual can be found under this link.

Product Page and Download

You can find the Aurora Agent product page and the download links here.

ASGARD v2.12 Released

Jan 24, 2022 | ASGARD Management Center, Newsletter

The new ASGARD Management Center version 2.12 adds new features and fixes several issues that were introduced with the version 2.11 in December last year.

Better Sigma Rule Management

We’ve added new features and improved the usability of the sigma rule management section, which is relevant for the released LogWatcher agent and beta customers testing our new Aurora agent.

 The most important new features are the false positive and response editor, which allows Aurora customers to configure response actions for a triggering rule. 

The false positive filter enables users to add filters that, instead of changing the  original rule, extend it during deployment. This makes it easy to use updated rules with the same custom filter values that are only relevant in the user’s environment. 

Revised Updates Section

The update section for the scanners and signatures has been revised. Each action has been reworked. Users can now trigger and update manually and check the log of the update process in a separate tab. 

Full change log:

– Feature: Support Aurora Agent (Beta Only)
– Feature: Manage Sigma Responses and False Positives (Aurora Only)
– Feature: Enable / Disable Sigma Rules
– Feature: Manually check for THOR and Signature Updates
– Feature: Show log of previous update process
– Feature: Auto Config for Sigma Rulesets (Automatically add new Sigma Rules based on level)
– Feature: The UI now has a lot more indicators for e.g. ‘Asset Requests’, ‘Uncompiled Rulesets’ and more
– Feature: Added more graphs to overview page, e.g. incoming Aurora and Log Watcher events
– Feature: Added bulk update for available Sigma rule updates
– Feature: Added default Sigma Rulesets (if no ruleset has been created yet)
– Feature: Added background routine that removes older and unused THOR / Signature versions
– Feature: Edit Scan Templates
– Feature: Search THOR Flags / Aurora Options
– Feature: Download THOR Zip with target hostname as filename
– Change: Improved Server Status indicators
– Change: Improved licensing
– Change: LDAP users require at least one LDAP role, otherwise they are not authenticated anymore
– Change: Updated Sigma rules
– Change: Cosmetics and UX improvements
– Change: Updated default THOR and Signature auto-update config
– Change: Added more links and password reset help to login page
– Change: Improved usability and feedback in IOC Management section
– Change: Require current password for password change
– Bugfix: Re-added and improved “no labels” filter in assets table
– Bugfix: Re-added resize buttons for Remote Console
– Bugfix: Fixed an issue that causes some API keys to be corrupt
– Bugfix: Fixed non-working ‘Install Service Controller’ playbook on Master ASGARD
– Bugfix: Updated interrogate job to detect ‘Windows 11’ correctly
– Bugfix: Fixed corrupt ‘Is Domain Controller: No’ filter
– Bugfix: Fixed missing default value when editing Sigma or YARA rules in IOC Management
– Bugfix: Fixed non-working “use newer Sigma rule” button
– Bugfix: Fixed CRLF issues in IOC Management for some IOC types
– Bugfix: Fixed some missing MISP iocs in THOR download package
– Bugfix: Fixed permissions on some files that caused backup process of ASGARD config files on Master ASGARD to not work properly
– Bugfix: Fixed encryption issues with custom signatures for THOR Lite
– Bugfix: Fixed missing import in ntp config that causes ntp to not work properly on some ASGARDs
– Bugfix: Fixed tasks that are pending forever due to unknown task module
– Bugfix: Fixed non-working rsyslog reload after monthly logrotation
– Bugfix: Fixed wrong file extension of stdout and stderr file in group task result package

To install the update, visit the “Updates > Management Center” section. 

Product Surveys – Tell us what you think

Jan 10, 2022 | ASGARD Analysis Cockpit, ASGARD Management Center, Newsletter, Nextron, THOR

We’d like to know your opinion on our products and therefore ask you to participate in our product surveys. Each of them takes between 2 and 5 minutes of your time, depending on how much you’d like to tell us.

THOR Customer Satisfaction Survey

You find the survey here.

ASGARD Customer Satisfaction Survey

You find the survey here.

Analysis Cockpit Customer Satisfaction Survey

You find the survey here.

Public Feature Collection

We also plan to publicly collect feature requests and allow you to up- or downvote requests of other users, comment on them and get informed when a feature has been implemented.

 

ASGARD: Check your Signature Versions

Dec 17, 2021 | ASGARD Management Center, Bug Report, Newsletter, Nextron

It came to our attention that under certain circumstances, after the upgrade to ASGARD 2.11, some ASGARD instances lost their scheduled task to automatically assign the newest signatures to scan jobs . We advice customers to review their update configuration if they are affected. Go to Updates > Scanners and Signatures. If you are affected the column ‘Automatically use newest version’ shows ‘not configured’.

In order to resolve this issue, you need to schedule a time for signature updates. Use the action button with the clock icon. We recommend an interval of 1 day (see the screenshot).

After you have entered the new schedule, you should see the configured date and interval in the “Automatically use newest revision” column.

The same mechanism is used to configure when new THOR versions should be used for scans. We recommend to use the default, which is also a daily update interval.

Log4j Evaluations with ASGARD

Dec 17, 2021 | ASGARD Management Center, Newsletter, Tool, Tutorial

We’ve created two ASGARD playbooks that can help you find Log4j libraries affected by CVE-2021-44228 (log4shell) and CVE-2021-45046 in your environment. 

Both playbooks can be found in our public Github repository. 

We’ve created a playbook named “log4j-analysis” that helps you find instances that use versions of “log4j”. An additional evaluation script can be used to process the ASGARD playbook results and distinguish between affected and unaffected versions. 

Another playbook named “log4shell-detector” allows you to run a script provided by our head of research on all Linux systems to detect exploitation attempts in log files.

The results of the evaluation script that processes the results of the “log4j-analysis” playbook look like this. 

WordPress Cookie Plugin by Real Cookie Banner