GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → codeyourweb → irma

codeyourweb / irma

Licence: MIT License
enpoint detection / live analysis & sandbox host / signatures quality test

Programming Languages

go
31211 projects - #10 most used programming language

Labels

threat-huntingyara-scannerlive-forensicendpoint-detection-response

Projects that are alternatives of or similar to irma

Judge-Jury-and-Executable
A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.
Stars: ✭ 66 (+164%)
Mutual labels:  threat-hunting, yara-scanner
YAFRA
YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.
Stars: ✭ 22 (-12%)
Mutual labels:  threat-hunting
Scrummage
The Ultimate OSINT and Threat Hunting Framework
Stars: ✭ 355 (+1320%)
Mutual labels:  threat-hunting
Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, tools, etc.
Stars: ✭ 261 (+944%)
Mutual labels:  threat-hunting
S2AN
S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator
Stars: ✭ 70 (+180%)
Mutual labels:  threat-hunting
Vendor-Threat-Triage-Lookup
Lookup file hashes, domain names and IP addresses using various vendors to assist with triaging potential threats.
Stars: ✭ 17 (-32%)
Mutual labels:  threat-hunting
hassh-utils
hassh-utils: Nmap NSE Script and Docker image for HASSH - the SSH client/server fingerprinting method (https://github.com/salesforce/hassh)
Stars: ✭ 41 (+64%)
Mutual labels:  threat-hunting
sophos-central-api-connector
Leverage Sophos Central API
Stars: ✭ 17 (-32%)
Mutual labels:  threat-hunting
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (+364%)
Mutual labels:  threat-hunting
pyeti
Python bindings for Yeti's API
Stars: ✭ 15 (-40%)
Mutual labels:  threat-hunting
detection-rules
Threat Detection & Anomaly Detection rules for popular open-source components
Stars: ✭ 34 (+36%)
Mutual labels:  threat-hunting
YaraSharp
C# wrapper around the Yara pattern matching library
Stars: ✭ 29 (+16%)
Mutual labels:  yara-scanner
YaraStation
Yara station is a management portal for Neo23x0-Loki. The mission is to transform the standalone nature of the Loki scanner into a centralized management solution that facilitates result investigation and easier scanning capabilities.
Stars: ✭ 25 (+0%)
Mutual labels:  yara-scanner
Threathunting-book
Threat hunting Web Windows AD linux ATT&CK TTPs
Stars: ✭ 338 (+1252%)
Mutual labels:  threat-hunting
IronNetTR
Threat research and reporting from IronNet's Threat Research Teams
Stars: ✭ 36 (+44%)
Mutual labels:  threat-hunting
kestrel-lang
Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.
Stars: ✭ 165 (+560%)
Mutual labels:  threat-hunting
BLUELAY
Searches online paste sites for certain search terms which can indicate a possible data breach.
Stars: ✭ 24 (-4%)
Mutual labels:  threat-hunting
AutonomousThreatSweep
Threat Hunting queries for various attacks
Stars: ✭ 70 (+180%)
Mutual labels:  threat-hunting
Memoirs-of-a-Threat-Hunter
My personal experience in Threat Hunting and knowledge gained so far.
Stars: ✭ 17 (-32%)
Mutual labels:  threat-hunting
OSINT-Brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
Stars: ✭ 508 (+1932%)
Mutual labels:  threat-hunting
View All Similar Projects ➔

IRMA - Incident Response - Minimal Analysis

What is this project designed for?

IRMA is a lightweight tool made for live forensics on Windows Platform. It is focused on three use cases:

  • enpoint detection - live analysis, quarantine and eradication of malware on a workstation
  • live analysis & sandbox host - logging and instant notifications for malware TTP's assessment
  • signatures quality test - scan your endpoint baseline and check for false positives

How IRMA scan for malware behaviour?

IRMA is intended to work with both user or administrator rights. Based on your user privileges it can:

  • implements the YARA library and regularly scan the workstation's files and memory
  • search for execution context (parent process, regkey, scheduled task persistence) Every suspect behaviour could be text logged, notified to the user, and/or eradicated

What does it scan?

Currently, IRMA is able to:

  • list running processes and log for suspiscious actions
  • list common persistence mecanisms (registry keys / scheduled tasks / startup folder links)
  • perform YARA scan on files and memory
  • dump / quarantine suspiscious artefacts
  • spawn fake analysis processes to make the computer look like an analysis platform

Installation

Feel free to download compiled release of this software. If you want to compile from sources, it could be a little bit tricky cause it's stronly depends of go-yara and CGO compilation. You'll find a detailed documentation here

Usage

usage: irma [-h|--help] -c|--configuration "<value>" [-b|--builder "<value>"]

            Incident Response - Minimal Analysis

Arguments:

  -h  --help           Print help information
  -c  --configuration  yaml configuration file
  -b  --builder        create a standalone launcher executable with packed
                       rules and configuration.

Scan according to your needs

IRMA embeds a configuration file in order to define which files to scan, and where to scan them.

irma.exe -c configuration.yaml

EDR, rules and configuration packing

IRMA builder mode lets you create a standalone, static compiled, self-extracting archive. It contains irma binary, configuration file, and signatures. Hence, this binary could be deployed on any other system and launch without additional configuration.

irma.exe -c configuration.yaml -b irma-sfx-binary.exe

About this project and future versions

I undertook this project initially in order to learn Go. Then little by little I tried to understand how to use the Win32 API and finally to read the process memory on a Windows system. Initially focused on system oriented live forensics, I plan to enhance IRMA functionalities with network based detection & analysis.

Further versions may contains:

  • SNORT/Suricata rules analysis
  • Transfer of analysis results to a SIEM
  • Agent management platform - Command and control ability

Feel free to ask for new features or create pull request if your interested in this project.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].