The first update is Pinpoint Version 0.2.0 (which was actually released back in February) from Kahu Security. The tool is great for helping to identify possible malicious content on a webpage. The following description of the tool is taken directly from website:
"Fetches a webpage and then enumerates and analyzes its components to help identify any infected files. Pinpoint gives you various options when making an HTTP request including spoofing the user-agent string and referer. Pinpoint will not render any of the content."
The second update is PEStudio, from Marc Ochsenmeier, who has been EXTREMELY busy pushing out updates to his amazing tool. The most recent update to PEStudio has "extended blacklist and Features detection as well as fixing a bug when handling 64-bit images". Marc has also set up a Paypal donation option on his website, if you have used PEStudio to help with any of your analysis and/or research I encourage you to consider donating as a way of saying "Thank you Marc!" for all of the time, effort, and work he has put into PEStudio. I would gladly pay for a tool like PEStudio, but am very grateful that Marc offers it for free!
The third update comes as a result of using the Live Response collection in a real-world response case. After being alerted to some possible files of interest that were identified by the other tools in the script, I wished that I had the hashes of some of those files to perform some additional research to attempt to determine if those files were legitimate Windows files or if they were malicious but attempting to "look" like Windows files. If run with Administrative privileges, the script will now compute the md5 and SHA256 of Windows PE files in the "%WINDIR%\system32" folder and "%SystemDrive%/Temp" folder (if it exists). It will also compute the md5 and SHA256 of all of the files in the "%TEMP%" folder of the currently logged on user. (COMMENT: I am working on doing this for each user of a system, I need to do some more testing in an effort to perform this in the most efficient (least system intensive) way possible).
I hope that you find the update(s) useful and as always, if you come across anything to help make the collection better or if there is a feature or option you would like to add or see, please let me know!
LiveResponseCollection-Cedarpelta.zip - download here
MD5: 7bc32091c1e7d773162fbdc9455f6432
SHA256: 2c32984adf2b5b584761f61bd58b61dfc0c62b27b117be40617fa260596d9c63
Updated: September 5, 2019
No comments:
Post a Comment