GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → swisscom → PowerGRR

swisscom / PowerGRR

Licence: MIT license
PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

Programming Languages

powershell
5483 projects

Labels

incident-responsethreat-huntinggrrpowershell-module

Projects that are alternatives of or similar to PowerGRR

Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Stars: ✭ 976 (+1776.92%)
Mutual labels:  incident-response, threat-hunting
Azure-Sentinel-4-SecOps
Microsoft Sentinel SOC Operations
Stars: ✭ 140 (+169.23%)
Mutual labels:  incident-response, threat-hunting
Ioc Explorer
Explore Indicators of Compromise Automatically
Stars: ✭ 73 (+40.38%)
Mutual labels:  incident-response, threat-hunting
Watcher
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
Stars: ✭ 324 (+523.08%)
Mutual labels:  incident-response, threat-hunting
Patrowlengines
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 162 (+211.54%)
Mutual labels:  incident-response, threat-hunting
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (+598.08%)
Mutual labels:  incident-response, threat-hunting
Patrowldocs
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 105 (+101.92%)
Mutual labels:  incident-response, threat-hunting
YAFRA
YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.
Stars: ✭ 22 (-57.69%)
Mutual labels:  incident-response, threat-hunting
Oriana
Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
Stars: ✭ 152 (+192.31%)
Mutual labels:  incident-response, threat-hunting
Intelowl
Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale
Stars: ✭ 2,114 (+3965.38%)
Mutual labels:  incident-response, threat-hunting
Apt Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
Stars: ✭ 297 (+471.15%)
Mutual labels:  incident-response, threat-hunting
evtx-hunter
evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.
Stars: ✭ 122 (+134.62%)
Mutual labels:  incident-response, threat-hunting
Threatpinchlookup
Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension
Stars: ✭ 257 (+394.23%)
Mutual labels:  incident-response, threat-hunting
Fcl
FCL (Fileless Command Lines) - Known command lines of fileless malicious executions
Stars: ✭ 409 (+686.54%)
Mutual labels:  incident-response, threat-hunting
rhq
Recon Hunt Queries
Stars: ✭ 66 (+26.92%)
Mutual labels:  incident-response, threat-hunting
Threathunt
ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
Stars: ✭ 92 (+76.92%)
Mutual labels:  incident-response, threat-hunting
ir scripts
incident response scripts
Stars: ✭ 17 (-67.31%)
Mutual labels:  incident-response, threat-hunting
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (+123.08%)
Mutual labels:  incident-response, threat-hunting
Mthc
All-in-one bundle of MISP, TheHive and Cortex
Stars: ✭ 134 (+157.69%)
Mutual labels:  incident-response, threat-hunting
Weffles
Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
Stars: ✭ 176 (+238.46%)
Mutual labels:  incident-response, threat-hunting
View All Similar Projects ➔

alt text

PowerGRR - PowerShell Module for GRR API

PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

Please see Command Documentation, Wiki and CHANGELOG.

What is PowerGRR?

PowerGRR is a PowerShell module for the GRR API working on Windows, macOS and Linux. GRR Rapid Response is an incident response framework focused on remote live forensics. PowerGRR allows working with flows, hunts, labels, artifacts, approvals and the search feature. Furthermore, it allows working with the computer names instead of the GRR internal client id. This makes handling and working with other tools more easy because often you just have the computer names. PowerGRR also enables you to easily document your work in text form which is then directly reusable by others.

Some of the use cases where PowerGRR could speed up the work:

The following flow types are available for hunts and flows and the target group is chosen based on labels or the OS. See also command help for the available flow types.

  • Netstat, ListProcesses, FileFinder, RegistryFinder, ExecutePythonHack, ArtifactCollectorFlow, YaraProcessScan

Installation

Update March 2022: Install PowerGRR from PowerShell Gallery was only supported until March 2022. Afterwards, only manual install through Github is provided. See CHANGELOG for more details about versions.

  • Install PowerGRR from Github:

    • Clone or download the repo into your module path folder, usually ~\Documents\WindowsPowerShell\modules on Windows or ~/.local/share/powershell/Modules/ on macOS (see $env:PSModulePath).
    • Clone or download the files to any other folder (could also be a share).
    • Windows Make sure to unblock the files when downloaded from the Internet by opening the properties page of the .psd1 and .psm1 files and checking "Unblock" at the bottom.

    The location changes how the module is imported.

Configuration

  1. Create a 'powergrr-config.ps1' in the profile folder ($env:USERPROFILE or $env:HOME) or in the root folder of the module.
  2. Set the config variables as needed.
    • [MUST] $GRRUrl: GRR server's URL.
    • [OPTIONAL] $GRRIgnoreCertificateErrors: If set to $true certificate errors are ignored.
    • [OPTIONAL] $GRRClientCertIssuer: If set, the client certificate from the Windows cert store signed by the given issuer is used.
    • [OPTIONAL] $GRRClientCertFilePath: If set, the client certificate file is used for the authentication.

It's also possible to set these variables in the console.

Example Configs

$GRRUrl = "https://grrserver.tld"
$GRRUrl = "https://grrserver.tld"
$GRRClientCertIssuer = "issuer of the certificate for client auth"

If you want to get crazy you could even use a config file file looking like this if you need to constantly change the GRR config otherwise. You only need to change the comment for the GRRUrl.

#$GRRUrl = "https://main-grrserver.tld"
$GRRUrl = "https://test-grrserver.tld"
$GRRIgnoreCertificateErrors = $( if ($GRRUrl -match "test") { $true } )
$GRRClientCertIssuer = $( if ($GRRUrl -match "main") { "certificate issuer" } )

Usage

Use command -<tab> to tab between the available parameters or use command -<ctrl+space> to display a list of all paremeters. Some commands use dynamic parameters which are only available after selecting the main one, e.g. in Invoke-GRRFlow first choose your flow type with -Flow ... and then the flow-specific parameters become available.

Import

If PowerGRR was saved inside the module path run the following command:

Import-Module PowerGRR -force

If PowerGRR was saved outside the module path run the command:

Import-Module <path to module>\PowerGRR.psd1 -force

Authentication

  1. Store your GRR credentials for any subsequent PowerGRR command or otherwise you will be prompted when running the commands. Either provide the credentials with -Credential in each command or use the variable $GRRCredential to set the credentials which then will be used without the need for supplying -Credential.
$GRRCredential = Microsoft.PowerShell.Security\get-credential
  1. If you use client certificate authentication set the corresponding config variable as described in Configuration above.

Cmdlets

Please see docs for the list of all available commands and the wiki for further information how you could use and combine the different PowerGRR commands.

Use the common parameters like -WhatIf or -Verbose for troubleshooting and to see what the commands would do. WhatIf is implemented for every function which make any permanent change (e.g. start a flow, set a label, ...).

List available PowerGRR commands.

get-command -Module PowerGRR

List all PowerGRR commands for flows.

get-command -Module PowerGRR | sls flow

Help

Use help <command> to get the help for a command.

PS> help Get-GRRHuntInfo

NAME
    Get-GRRHuntInfo

OVERVIEW
    Get hunt info for a specific hunt.

SYNTAX
    Get-GRRHuntInfo [[-HuntId] <String>] [-Credential] <PSCredential> [-ShowJSON] [<CommonParameters>]
...

Use help <command> -Examples to get examples for a command.

PS> help Get-GRRHuntInfo -Examples

NAME
    Get-GRRHuntInfo

OVERVIEW
    Get hunt info for a specific hunt.

    Example 1

    PS C:\> Get-GRRHuntInfo "H:AAAAAAAA" -Credential $cred
...

Example

The following examples shows how you could combine the different PowerGRR functions to quickly label some clients, start a flow against them or a hunt based on a label and read the results. You can find more code snippets and ideas in the wiki and see section help above how to use the help system in PowerShell.

Use $GRRCredential for setting the credentials before running the commands and the parameter -Credential is not needed anymore for each command.

# Read the client information to check LastSeenAt and the OSVersion
Get-GRRClientIdFromComputerName -ComputerName WIN-DESKTOP01,MBP-LAPTOP02,WIN-DESKTOP03,WIN-DESKTOP04 `
                                -Credential $creds
 
ComputerName    ClientId           LastSeenAt          OSVersion
------------    --------           ----------          ---------
WIN-DESKTOP01   C.aaaaaaaaaaaaaaaa 18.05.2017 15:48:17 10.0.10586
WIN-DESKTOP01   C.xxxxxxxxxxxxxxxx 03.04.2017 14:55:37 6.1.7601
MBP-LAPTOP02    C.bbbbbbbbbbbbbbbb 18.05.2017 15:49:12 16.6.0
WIN-DESKTOP03   C.dddddddddddddddd 11.03.2017 10:23:51 10.0.10586
WIN-DESKTOP04   C.eeeeeeeeeeeeeeee 11.03.2017 10:23:51 10.0.10586

(Get-GRRClientIdFromComputerName WIN-DESKTOP01).clientid

# Set a label for multiple hosts during incident response with the parameter
# __ComputerName__
Set-GRRLabel -ComputerName WIN-DESKTOP01, WIN-DESKTOP03, WIN-DESKTOP04 -Label INC02_Windows `
             -Credential $creds

# or through the pipeline
"MBP-LAPTOP02" | Set-GRRLabel -Label INC02_macOS -Credential $creds

# Now you can work with that label within GRR UI or in the shell. Use
# -OnlyComputerName to only display the hostname instead of the full GRR client
# object
$clients = Find-GRRClientByLabel -SearchString INC01 -Credential $creds -OnlyComputerName

# Start a flow on the affected clients
$clients | Invoke-GRRFlow -flow RegistryFinder `
                          -key "HKEY_USERS/%%users.sid%%/Software/Microsoft/Windows/CurrentVersion/Run/*" `
                          -Credential $cred

# Get flow results - see output of specific flow ids. Using
# -OnlyPayload navigates directly to the payload section of the results
# within the returned GRR object
$ret = Get-GRRFlowResult -Credential $cred -ComputerName WIN-DESKTOP01 -FlowId "F:11111111" -OnlyPayload

# Show only the registry paths from the returned GRR object. Sometimes the
# output is base64 encoded. Get-GRRFlowResult decodes the string if
# possible. 
$ret.stat_entry.registry_data

# Alternative you can start a hunt against that label. The EmailAddress
# parameter is optional and notifies you about the first hit. The OnlyUrl
# parameter shows only the URL to the hunt.
$HuntId = New-GRRHunt -HuntDescription "Search for notepad.exe" `
            -Flow FileFinder `
            -path "c:\notepad.exe" `
            -MatchMode MATCH_ALL `
            -actiontype hash `
            -RuleType label `
            -Label INC01 `
            -EmailAddress your@email.tld `
            -Credential $creds `
            -OnlyUrl `
            -Verbose

# If needed request an approval
$ApprovalId = New-GRRHuntApproval -Credential $cred -HuntId H:AAAAAAAA -NotifiedUsers user1 `
                    -Reason "Hunting for notepad.exe - INC01" -OnlyId

# Start the hunt
Start-GRRHunt -Credential $creds -HuntId $HuntId

# Start the hunt after approval got within the given timeout
Start-GRRHunt -HuntId $HuntId -Credential $creds -Wait -ApprovalId $ApprovalId -TimeoutInMinutes 15

# Read hunt restuls
$ret = Get-GRRHuntResult -Credential $cred -HuntId $HuntId

# Inspect results
$ret.items

# Filter results as needed - e.g. see unique clients which were affected 
$ret.items.client_id | get-unique

# Get unique computer names based on the list of client ids
$ret.items.client_id | Get-GRRComputerNameFromClientId -Credential $cred | get-unique

# Get unique file paths from a file finder hunt
$ret.items.payload.stat_entry.pathspec.path | sort -u

# Remove the label if you don't use it anymore
$clients | Remove-GRRLabel -SearchString INC01 -$Credential $creds

# Find specific artifact names for ArtifactCollectorFlow
$ret = Get-GRRArtifact
$ret | select -first 1

Name        : APTSources
Description : APT package sources list
IsCustom    : False
URLs        : http://manpages.ubuntu.com/manpages/trusty/en/man5/sources.list.5.html
Labels      : {Configuration Files, System}
SupportedOS : {Linux}
Type        : FILE
Attributes  : @{paths=System.Object[]}

$ret | ? { $_.description -match "registry" }

# If you use a GRR API request for which there is no predefined function, 
# then use Invoke-GRRRequest with the specific API endpoint, as an example, 
# we list all flows of a given client
$ret = Invoke-GRRRequest -Url /clients/$((Get-GRRClientIdFromComputerName WIN-DESKTOP01).clientid)/flows
$ret.items

Contributing

See CONTRIBUTING for general guidelines and some inner workings of PowerGRR.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].