Dec 23, 2020 | Newsletter, THOR, THOR Lite
We would like to inform you about three new comfort features that will be available in the upcoming THOR versions including THOR Lite.
The new HTML reports allow analysts to filter elements that turn out to be false positives and remove them from the current view. It also adds useful lookup functions for Virustotal, RiskIQ and VALHALLA.
Filter and remove false positives in your analysis
Apply filters directly from the modules menu and reduce the events to events from module X only
Direct lookups on Virustotal, RiskIQ and VALHALLA right from the report
The new report functions will be available in the upcoming THOR v10.5.10 and THOR TechPreview v10.6.3, which will be released in January 2021.
Due to ongoing demand, we’ve added a progress bar to all longer running modules and a progress indicator to all the other modules. So far, we’ve avoided adding a progress bar or any kind of command line output that works with control characters to reduce the risks of side effects caused by THOR running in non-interactive sessions, e.g. with Splunk Forwarders’ scripted input.
But THOR version 10 is able to determine if it is running in an interactive session and enables the progress bar only in these cases.
Progress bar in “Filescan” module
Progress bar in “Eventlog” module
New Option in Interrupt Menu
Another feature to highlight is the option to skip a module that doesn’t finish or seems to be stalled.
The interrupt menu (CTRL+C) offers another option (X) to skip the current module and continue with the next one.
Dec 19, 2020 | Newsletter, THOR
We are glad to announce significant performance improvements in the latest versions of THOR.
We’ve refactored several processing units to bulk scan elements that have previously been checked each at a time. These changes affect the modules “Eventlog”, “Registry”, “RegistryHive” and “Logscan”.
The performance improvements are impressive, especially on systems with big Windows event logs or log files on disk, but also on systems that contain a lot of registry hives like domain controllers or multi-user systems.
As these changes result in significant speed benefits, we’ve decided to exclude some elements from the “max-file-size” limit.
In the past, log files or registry hives bigger than “max-file-size” (default 12MB) have been skipped in normal scan modes. Only in intense (–intense) and lab scanning mode (–fsonly / –lab in TechPreview) these files have been included and analyzed with the respective modules.
THOR v10.5.9 and THOR v10.6.2 TechPreview now include these elements in their deeper analysis during file system scans. This could lead to longer scan times in some cases. We believe that overall scans turn out to be suprisingly faster and would be interested in feedback on the scan durations in your environments.
Dec 17, 2020 | Newsletter, THOR, YARA
We’ve been working on a legacy version of our scanner THOR 10 for a while and started our closed BETA, which is available to all current customers on special request.
The THOR legacy version does not include the following modules/features:
- Module: Eventlog scanning
- Feature: Deeper process analysis for injection, Doppelgaenging, hollowing etc. using PE-Sieve
THOR Legacy runs on:
- Windows XP x86
- Windows Server 2003 x86 / x64
- Windows Vista x86 / x64
- Windows Server 2008 x64
We offer only limited support for this version and don’t plan to release it for old Linux or macOS versions.
THOR 10 Legacy on Windows Server 2003
THOR 10 Legacy on Windows XP
Please contact us if you are interested in participating in the closed BETA.
Nov 11, 2020 | Newsletter, THOR
THOR version 10.6, which is currently available as TechPreview, introduces several new features that facilitates the use of THOR in a digital forensics lab. Since not all of the features provided with the “Forensic Lab” license type are well-known, we would like to introduce all features that are unique to that special license type in this blog post.
Forensic Lab License Features
- Multi-threaded scanning (improves scan speed significantly on multi-core systems)
- Multi-instance scanning (run multiple THOR processes on a single machine)
- Memory dump scanning (use the so-called DeepDive on dumped data, e.g. memory images)
- Dropzone mode (monitor folder for new files, scan them and generate events)
- Hostname replacement (replace hostname in log messages with a given string)
- Virtual drive mapping (Map a mounted drive e.g. S: to a virtual drive e.g. C: to allow lookups for files mentioned in analyzed entries; more info here)
Multi-threaded scanning allows users on forensic workstations to make full use of the system’s CPU cores. Multi-threading isn’t available in all modules but the ones with the biggest run time:
- File Scan
- Registry Scan
- Eventlog Scan
It is also available in DropZone mode, which means that dropping dropping 12 files in the monitored folder would create 12 threads scanning these files in parallel.
We plan to refactor the following modules to support multi-threading:
Multi-instance scanning means that you can start multiple executables of THOR on a single workstation.
This is often needed in lab environments to process mounted disk images in parallel and create separate reports for these two cases.
Memory Image Scanning
We provide a module named “DeepDive” that analyzes files of any size by reading big chunks of data and applying YARA rules to the chunks of data, showing YARA matches within that data with offset and matching strings / bytes.
It is not meant for the analysis of disk images but memory dumps, crash dumps or even PCAP files.
The drop zone mode allows you to monitor a given folder for new files. All files dropped to that folder will be scanned and then deleted. Customers use text and syslog output to report back findings.
The drop zone mode helps you to integrate THOR in a bigger analysis environment. We recommend dropping files in their original form with the correct filename and extension, since some of the rules make use of these meta data values.
Side note: If you like the idea of a drop zone, you’ll love THOR Thunderstorm.
Other Comfort Features
Other features relate to command line parameters that help you with different aspects of disk image scanning your forensic lab. We’ve added these features over the years based on a lot for feedback from DFIR specialists and BETA program users.
Oct 1, 2020 | Newsletter, THOR, Thunderstorm, YARA
We are proud to announce a groundbreaking new scan mode named “Thunderstorm” that we’ve integrated into preview builds of the upcoming THOR version 10.6.
This mode of operation turns THOR into a RESTful web service that is able to process thousands of samples per minute sent from any device within the network.
Think of it as your ultra-fast on-premise scan service, wich is bundled with more than 13,000 hand-crafted YARA rules focusing on persistent threats and forensic artefacts.
Collect files and submit them for analysis from any operating system and any hardware platform. The possibilities are limitless.
With this blog post, we’d like to highlight some of these new possibilities.
Thunder rolls, lightning strikes & the hammer flies across the sky.
God of the weather,
chariot of the storm,
master of rain & torrents.
Son of the strength
of Mother Earth,
I ask you to grant me that strength for myself.
What is THOR Thunderstorm?
A RESTful web service that receives samples and returns a scan result. It is feature-rich and very fast.
Use Case 1 – Remote File Collection
During forensic investigations, automated file collection (ESI) from one or multiple remote systems can be combined with THOR Thunderstorm to improve the forensic anylsis.
Alerts and warnings produced by THOR Thunderstorm highlight interesting elements in file data, registry hives, eventlog files and more.
Use Case 2 – ICS Networks
ICS networks are mission critical, requiring immediate and high-availability. The installation of an endpoint agent or running a portable scanner is often out of question.
With THOR Thunderstorm, you just have to collect and submit the files.
Use Case 3 – Out of Reach Devices
Since file collection is a lot easier than endpoint scanning, all you need is way to export the remote system’s files or directly send them to THOR Thunderstorm.
Imagine that you can collect and submit files from network devices, telephone systems or embedded devices.
Use Case 4 – Out of Reach Operating Systems
File collection scripts for many old or usually unsupported operating systems allow you to upload samples for analysis.
Select files based on size, age or type and schedule frequent upload tasks to analyze only new or modified files.
Use Case 5 – S3 Bucket Scanning
We’ve been working with our partner Adolus to showcase a tuned version of AirBnb’s BinaryAlert in which the standard YARA analyzer has been replaced by THOR Thunderstorm.
By using it in a container that scales with the demand, you can process millions of files in a few minutes.
Most operating system provide tools to walk the file system and submit files via HTTP. The following examples are intentionally short and compact to inspire you with their simplicity. Think of all devices that you could analyze this way. No agent, no portable scanner, just simple file submission via HTTP.
Windows 10 Batch
This example shows a simple batch file that walks recursively over a given folder an submits all files. You could extend it to the whole disk and reduce the submission to certain file extensions (e.g. exe, bat, ps1, js).
Linux Web Server
This examples shows how easy it is to get all files in a web server root checked by THOR Thunderstorm just by using bash, find and curl.
The following slide lists the different components that can be used with THOR Thunderstorm. We provide a server installer script, collectors, a Python API client and update scripts.
In addition to the Thunderstorm server we provide a set of simple sample collection tools called Thunderstorm Collectors, a Python-based API library with command line client and a set of helper scripts.
The Thunderstorm Collector repository contains a Go based collector, precompiled for many different operating systems and architectures as well as collectors scripts (Batch, Bash, PowerShell).
We have pre-build collectors for Windows, Linux, macOS, AIX, Solaris on x86, x64, Arm, PowerPC, MIPS, RISC-V, Plan9, S390x (IBM Z) architectures.
These collectors allow you select files based on age, size and type for submission to a Thunderstorm server.
It is easy to set up a task like:
“Select all files that have been created or modified within the last 24 hours and submit them to Thunderstorm for analysis. Run this task daily.”
A collection task requires 0.75-2% of the CPU and 20MB memory.
Our collectors run on any operating system and processor architecture
It allows ultra fast collection runs. (Our tests: Win 10, collect last 3 days, any type, full disk = 3 minutes run)
The service can be started in two scan modes:
In the pure YARA mode (–pure-yara) THOR Thunderstorm only applies the 13,000 internal and all custom YARA rules to the submitted samples. It’s leightweight and super fast.
The full-featured mode is the default. In this mode Thunderstorm also parses and analyses Windows Eventlogs (EVTX), registry hives, memory dumps, Windows error reports (WER) and more. It’s not just a YARA scan, but a full forensic processing.
THOR Thunderstorm can be installed on any internal system and runs as a service within your network
Store suspicious or all transmitted samples with a reference to the source system to facilitate the deeper analysis
THOR Thunderstorm supports the analysis of different file types that get collected for forensic analysis purposes (e.g. EVTX files, Registry Hives)
Add you own YARA signatures, Sigma rules, hash and filename IOCs and apply them to incoming samples
THOR Thunderstorm offers many ways to output information (Text, JSON, Syslog), which makes it easy to integrate the findings into your favorite SIEM system
Web GUI and API Documentation
The API documentation is embedded into the web service itself. You can even send requests right from the browser to test it live.
The Web GUI contains important information about the service like the signature set version, uptime, number of processed and queued samples and much more.
It contains some graphs that help you to assess the actual server load and processing speed.
It also contains links to the API documentation, the Python API library and the Thunderstorm Collectors for your convenience.
The following tasks are on our roadmap for THOR Thunderstorm
- Collector service that uses file system notifications to submit new files in real-time
- Cortex Analyzer
- ICAP Support (allows interfacing with Web Proxies)
- File format support: PCAP, MFT
- Recursive extraction of nested archives
- Docker setup guide
Please use the “GET STARTED” button in the upper right corner or this link to request more information.
The release slide deck contains more detailed information on some of the mentioned aspects.
Oct 1, 2020 | Newsletter, THOR, Thunderstorm
We are proud do announce the version 10.6 of THOR, which is the first one that gets released as a TechPreview. We’ve discussed the split-up into THOR and THOR TechPreview in a previous post.
The following post describes the most important new feature of the THOR v10.6 TechPreview version.
THOR 10.6 is the first version that support a new mode of operation – a RESTful web API service named THOR Thunderstorm. THOR Thunderstorm is able to receive thousands of samples per minute via web requests, scans them and returns a scan result.
We’ve outlined many use cases and features of THOR Thunderstorm in a separate blog post.
THOR Thunderstorm requires a separate license named “service license” to run.
Especially the customers with a lab license should be happy to hear that we’ve implemented multi-threaded scanning.
From now on, THOR can use multiple threads to process elements (files, registry keys, events in eventlog etc.).
This can boost the scan speed on mounted images significantly. Our tests on a 16 Core system showed a scan speed improvement of 1400%.
Reworked Quick Scan
Quick scan (–quick) is used when fast scan results are crucial. It usually takes less than 25 minutes to complete. This is achieved by skipping elements in the scan. Quick in versions previous to 10.6 do the following: they skip the Eventlog scan and scan only a set of 40+ highly relevant folders on disk.
The new quick scan doesn’t skip whole modules or directories anymore. For all previously skipped elements the new quick scan evaluates if they have been modified or created within the last 72 hours and scans only these elements.
This way the new quick scan is much more intense but should be only slightly slower.
- We’ve changed the ambigious “–fsonly” flag to “–lab” to indicate the best settings for scanning in a forensic lab (the old flag is still usable but hidden in the usage description)
- Virtual drive name mapping (used in lab scans to map the actual mount point to the original one)
- Minor changes to some log lines (extended field values)
Customers can download the THOR TechPreview version 10.6 in the Downloads section of the customer portal or use thor-util in it’s newest version to download that version with the flag “–techpreview”. ASGARD version 2.5.3 also supports scan runs with THOR TechPreview.
Aug 31, 2020 | Newsletter, THOR
Since its early days, THOR has always been focused on stability and detection rate. With the early module and feature set, we never had to make a compromise.
However, during the last 1-2 years, we had to make some decisions on the integration of new features and their default state in favor of stability. These decisions include e.g. the process dump feature, the PE-Sieve integration and Sigma scanning.
Detection and stability have become two competing goals. We do not want to make these hard decisions anymore and leave them to you. You decide, based on your use case, if you want to use the version with newest features and detection capabilities or the one with a maximum of stability.
With THOR version 10.6 we introduce a version named THOR TechPreview, which includes the newest features, refactored modules and new modes of operation.
THOR TechPreview is a special THOR version that contains the newest modules and great detection features, which have not yet been tested on thousands of systems.
Head of Research
The first release of THOR TechPreview will be version 10.6.
The standard version of THOR remains version 10.5 until the refactored and new features of the TechPreview have been proved to be stable. The expected release cycles of new version of THOR Tech Preview will be once a month, while new minor versions of THOR will be released only twice a year. Both versions receive bugfix updates and use the same signature set.
The current ASGARD Management Centers continue to use the standard THOR versions. The next minor release ASGARD 2.6, which is planned for October 2020, includes the option to use the TechPreview variant.
The TechPreview version is recommended for all use cases in which detection capabilities have higher priority than stability. We would e.g. always recommend the TechPreview for image scans in a forensics labs.
THOR TechPreview is not an untested version. It still goes through our internal testing on almost a hundred different test systems in 4 different test configurations.
Customers can download the new THOR TechPreview version from the download section in the customer portal once it gets released. Thor-Util version 1.11+ also supports the TechPreview download. We’ve planned the release for September 8.
Jul 29, 2020 | Newsletter, Nextron, Sigma, THOR
Our compromise assessment scanner THOR is able to apply Sigma rules during the local Eventlog analysis. This can help any customer that has no central SIEM system or performs a live forensic analysis on a system group that does not report to central monitoring.
By running THOR on these systems with activated Sigma feature, THOR becomes a kind of a distributed and portable SIEM.
Since the Sigma scan module isn’t active by default, we thought it a good idea to explain how to activate an use it in the best possible way.
Open Source Rule Set
By default THOR uses the open-source Sigma rule set with more than 500+ rules provided by the Sigma project on their Github page.
Since our head of research is also one of the project maintainers, it was reasonable to combine the detection capabilities of Sigma with THOR’s scanning functionality on the endpoint.
We comply with Sigma’s DRL (Detection Rule License) by including the rule authors in the event data produced by these rules.
Custom Sigma Rules
You can easily add you own Sigma rules by placing them in the “./custom-signatures/sigma” sub folder.
THOR’s Sigma Config
The THOR default configuration for Sigma can be found in the Sigma repository.
This configuration shows you, which Windows Eventlogs and Linux/Unix log files get analyzed by the Sigma module in THOR.
To activate the Sigma module simply use the “–sigma” flag (or “sigma: True” in a YML config file).
You can start a THOR scan that analyzes the local Eventlog and activates the Sigma feature with:
thor64.exe -a Eventlog --sigma
To run a Sigma scan on a single Eventlog e.g. Sysmon’s log, use the “-n” flag.
thor64.exe -a Eventlog --sigma -n "Microsoft-Windows-Sysmon/Operational"
To include the Sigma feature in a standard THOR scan and check only the last 3 days of the Windows Eventlogs to reduce the scan duration, use:
thor64.exe --sigma -lookback 3
Since this feature isn’t available in THOR Lite, please contact us via the “Get Started” button in the upper right corner and get a free trial voucher. Most customers that use THOR with Sigma choose one of our THOR license packs, especially the SOC Toolkit Pack, which was geared to the needs of today’s SOC teams.
May 28, 2020 | Newsletter, THOR, THOR Cloud, THOR Lite, VALHALLA
The following slides contain information on changes and new feature in several of our products.
Product Update and New Features
DOWNLOAD Slide Deck
Technical Implementation, Roadmap
DOWNLOAD Slide Deck