├── .github └── workflows │ ├── go_build_linux.yml │ └── go_build_windows.yml ├── Icon.png ├── LICENSE ├── README.linux-compilation.md ├── README.md ├── README.windows-compilation.md ├── configuration.go ├── examples ├── CISA-AA21-259A │ ├── CISA-AA21-259A.yaml │ ├── EncryptJSP.yar │ └── ReportGenerate_jsp.yar ├── example_configuration_api_triage.yaml ├── example_configuration_distant.yaml ├── example_configuration_linux.yaml ├── example_configuration_windows.yaml ├── example_rule_linux.yar ├── example_rule_windows.yar ├── example_windows_api_triage.yar ├── linux-fontonlake │ └── eset_fontonlake_linux.yaml ├── log4j_vuln_checker │ └── config-log4j_vuln_checker.yaml └── proxyshell │ └── drophell.yaml ├── finder.go ├── finder_test.go ├── go.mod ├── go.sum ├── gui.go ├── logger.go ├── main.go ├── main_test.go ├── progressbar.go ├── progressbar_test.go ├── resources ├── linux_sfx.elf └── windows_sfx.exe ├── screenshots ├── fastfinder_basicUI.jpg ├── fastfinder_configuration_linux.jpg ├── fastfinder_configuration_picker.jpg ├── fastfinder_linux_scan.jpg └── fastfinder_matchs.jpg ├── sfxbuilder.go ├── tests ├── config_test_ciphered.yml ├── config_test_standard.yml ├── rule_test_ciphered.yar └── rule_test_standard.yar ├── utils_common.go ├── utils_common_test.go ├── utils_linux.go ├── utils_windows.go ├── yaraprocessing.go └── yaraprocessing_test.go /.github/workflows/go_build_linux.yml: -------------------------------------------------------------------------------- 1 | name: fastfinder_build_linux 2 | 3 | on: [push, pull_request] 4 | 5 | jobs: 6 | linux_standard-build: 7 | runs-on: ubuntu-latest 8 | steps: 9 | - name: Install system dependencies 10 | run: | 11 | sudo apt-get update 12 | sudo apt-get install -y \ 13 | build-essential \ 14 | bison \ 15 | flex \ 16 | autoconf \ 17 | pkg-config \ 18 | automake \ 19 | libtool \ 20 | - name: Set up Go 21 | uses: actions/setup-go@v2 22 | with: 23 | go-version: 1.17 24 | - name: Install YARA v4.1 25 | run: | 26 | YARA_VERSION=4.1.3 27 | wget --no-verbose -O- https://github.com/VirusTotal/yara/archive/v${YARA_VERSION}.tar.gz | tar -C /tmp -xzf - 28 | ( cd /tmp/yara-${YARA_VERSION} && ./bootstrap.sh && sudo ./configure && sudo make && sudo make install ) 29 | - uses: actions/checkout@v2 30 | - name: Building Fastfinder 31 | run: | 32 | go build -trimpath -tags yara_static -a -ldflags '-s -w -extldflags "-static"' . 33 | ls 34 | sudo chmod +x fastfinder 35 | sudo ./fastfinder -h -------------------------------------------------------------------------------- /.github/workflows/go_build_windows.yml: -------------------------------------------------------------------------------- 1 | name: fastfinder_build_windows 2 | 3 | on: [push, pull_request] 4 | 5 | jobs: 6 | windows_standard-build: 7 | runs-on: windows-latest 8 | defaults: 9 | run: 10 | shell: msys2 {0} 11 | steps: 12 | - name: Install MSYS2 13 | uses: msys2/setup-msys2@v2 14 | with: 15 | msystem: MSYS 16 | path-type: minimal 17 | update: true 18 | install: mingw-w64-x86_64-toolchain mingw-w64-x86_64-pkg-config base-devel openssl-devel autoconf automake libtool unzip 19 | - name: Install YARA v4.1 20 | run: | 21 | wget -c https://github.com/VirusTotal/yara/archive/refs/tags/v4.1.3.zip -O /tmp/yara.zip 22 | cd /tmp && unzip yara.zip 23 | cd /tmp/yara-4.1.3 24 | export PATH=${PATH}:/c/msys64/mingw64/bin:/c/msys64/mingw64/lib:/c/msys64/mingw64/lib/pkgconfig 25 | ./bootstrap.sh 26 | ./configure 27 | make 28 | make install 29 | cp -r libyara/include/* /c/msys64/mingw64/include 30 | cp -r libyara/.libs/* /c/msys64/mingw64/lib 31 | cp libyara/yara.pc /c/msys64/mingw64/lib/pkgconfig 32 | - name: Set up Go 33 | uses: actions/setup-go@v2 34 | with: 35 | go-version: 1.17 36 | - uses: actions/checkout@v2 37 | - name: Building Fastfinder 38 | shell: powershell 39 | run: | 40 | $Env:PATH += ";C:/msys64/mingw64/include" 41 | $Env:PATH += ";C:/msys64/mingw64/lib" 42 | $Env:PATH += ";C:/msys64/mingw64/lib/pkgconfig" 43 | $Env:GOOS="windows" 44 | $Env:GOARCH="amd64" 45 | $Env:CGO_CFLAGS="-IC:/msys64/mingw64/include" 46 | $Env:CGO_LDFLAGS="-LC:/msys64/mingw64/lib -lyara -lcrypto" 47 | $Env:PKG_CONFIG_PATH="C:/msys64/mingw64/lib/pkgconfig" 48 | cd $Env:GITHUB_WORKSPACE 49 | go build -trimpath -tags yara_static -a -ldflags '-s -w -extldflags "-static"' . 50 | ls 51 | .\fastfinder.exe -h -------------------------------------------------------------------------------- /Icon.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/codeyourweb/fastfinder/3674dd00523c219562bd483607d93c830cd3b578/Icon.png -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 Jean-Pierre GARNIER 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.linux-compilation.md: -------------------------------------------------------------------------------- 1 | # Compiling instruction for _FastFinder_ on Linux 2 | 3 | _FastFinder_ was originally designed for Windows platform but it also work perfectly on Linux. Unlike other Go programs, if you want to compile or run it from source, you will need to install some libraries and compilation tools. Indeed, _FastFinder_ is strongly dependent of libyara, go-yara and CGO. Here's a little step by step guide: 4 | 5 | ## Before installation 6 | 7 | Please ensure having: 8 | * Go >= 1.17 9 | * GOPATH / GOOS / GOARCH correctly set 10 | * administrator rights to insall 11 | 12 | ## Compile YARA 13 | 14 | 1/ download YARA latest release source tarball (https://github.com/VirusTotal/yara) 15 | 2/ Make sure you have `automake`, `libtool`, `make`, `gcc` and `pkg-config` installed in your system. 16 | 2/ unzip and compile yara like this: 17 | ``` 18 | tar -zxf yara-.tar.gz 19 | cd . 20 | ./bootstrap.sh 21 | ./configure 22 | make 23 | make install 24 | ``` 25 | 3/ Run the test cases to make sure that everything is fine: 26 | ``` 27 | make check 28 | ``` 29 | 30 | ## Configure CGO 31 | CGO will link libyara and compile C instructions used by _Fastfinder_ (through go-yara project). Compiler and linker flags have to be set via the CGO_CFLAGS and CGO_LDFLAGS environment variables like this: 32 | ``` 33 | export CGO_CFLAGS="-I/libyara/include" 34 | export CGO_LDFLAGS="-L/libyara/.libs -lyara" 35 | ``` 36 | 37 | ## You're ready to Go! 38 | You can compile _FastFinder_ with the following command: 39 | ``` 40 | go build -tags yara_static -a -ldflags '-s -w' . 41 | ``` 42 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ![Fastfinder logo](./Icon.png) 2 | # _FastFinder_ - Incident Response - Fast suspicious file finder 3 | [![Golang](https://img.shields.io/badge/Go-1.17-blue.svg)](https://golang.org) ![Linux](https://img.shields.io/badge/Supports-Linux-green.svg) ![windows](https://img.shields.io/badge/Supports-windows-green.svg) 4 | ![build windows workflow](https://github.com/codeyourweb/fastfinder/actions/workflows/go_build_windows.yml/badge.svg) ![build windows workflow](https://github.com/codeyourweb/fastfinder/actions/workflows/go_build_linux.yml/badge.svg) 5 | 6 | ## What is this project designed for? 7 | _FastFinder_ is a lightweight tool made for threat hunting, live forensics and triage on both Windows and Linux Platforms. It is 8 | focused on endpoint enumeration and suspicious file finding based on various criterias: 9 | * file path / name 10 | * md5 / sha1 / sha256 checksum 11 | * simple string content match 12 | * complex content condition(s) based on YARA 13 | 14 | ## Ready for battle! 15 | * fastfinder has been tested in real cases in multiple CERT, CSIRT and SOC use cases 16 | * examples directory now include real malwares / suspect behaviors or vulnerability scan examples 17 | 18 | ### Installation 19 | Compiled release of this software are available. If you want to compile 20 | from sources, it could be a little bit tricky because it strongly depends of 21 | _go-yara_ and CGO compilation. Anyway, you'll find a detailed documentation [for windows](README.windows-compilation.md) and [for linux](README.linux-compilation.md) 22 | 23 | ### Usage 24 | ``` 25 | ___ __ ___ ___ __ ___ __ 26 | |__ /\ /__` | |__ | |\ | | \ |__ |__) 27 | | /~~\ .__/ | | | | \| |__/ |___ | \ 28 | 29 | 2021-2022 | Jean-Pierre GARNIER | @codeyourweb 30 | https://github.com/codeyourweb/fastfinder 31 | 32 | usage: fastfinder [-h|--help] [-c|--configuration ""] [-b|--build 33 | ""] [-o|--output ""] [-n|--no-window] 34 | [-u|--no-userinterface] [-v|--verbosity ] 35 | [-t|--triage] 36 | 37 | Incident Response - Fast suspicious file finder 38 | 39 | Arguments: 40 | 41 | -h --help Print help information 42 | -c --configuration Fastfind configuration file. Default: 43 | -b --build Output a standalone package with configuration and 44 | rules in a single binary 45 | -o --output Save fastfinder logs in the specified file 46 | -n --no-window Hide fastfinder window 47 | -u --no-userinterface Hide advanced user interface 48 | -v --verbosity File log verbosity 49 | | 4: Only alert 50 | | 3: Alert and errors 51 | | 2: Alerts,errors and I/O operations 52 | | 1: Full verbosity) 53 | . Default: 3 54 | -t --triage Triage mode (infinite run - scan every new file in 55 | the input path directories). Default: false 56 | ``` 57 | 58 | Depending on where you are looking for files, _FastFinder_ could be used with admin OR simple user rights. 59 | 60 | ### Scan and export file match according to your needs 61 | configuration examples are available [there](./examples) 62 | ``` 63 | input: 64 | path: [] # match file path AND / OR file name based on simple string 65 | content: 66 | grep: [] # match literal string value inside file content 67 | yara: [] # use yara rule and specify rules path(s) for more complex pattern search (wildcards / regex / conditions) 68 | checksum: [] # parse for md5/sha1/sha256 in file content 69 | options: 70 | contentMatchDependsOnPathMatch: true # if true, paths are a pre-filter for content searchs. If false, paths and content both generate matchs 71 | findInHardDrives: true # enumerate hard drive content 72 | findInRemovableDrives: true # enumerate removable drive content 73 | findInNetworkDrives: true # enumerate network drive content 74 | findInCDRomDrives: true # enumerate physical CD-ROM and mounted iso / vhd... 75 | output: 76 | copyMatchingFiles: true # create a copy of every matching file 77 | base64Files: true # base64 matched content before copy 78 | filesCopyPath: '' # empty value will copy matched files in the fastfinder.exe folder 79 | advancedparameters: 80 | yaraRC4Key: '' # yara rules can be (un)/ciphered using the specified RC4 key 81 | maxScanFilesize: 2048 # ignore files up to maxScanFileSize Mb (default: 2048) 82 | cleanMemoryIfFileGreaterThanSize: 512 # clean fastfinder internal memory after heavy file scan (default: 512Mb) 83 | ``` 84 | ### Search everywhere or in specified paths: 85 | * use '?' in paths for simple char wildcard (eg. powershe??.exe) 86 | * use '\\\*' in paths for multiple chars wildcard (eg. \\\*.exe) 87 | * regular expressions are also available , just enclose paths with slashes (eg. /[0-9]{8}\\.exe/) 88 | * environment variables can also be used (eg. %TEMP%\\myfile.exe) 89 | 90 | ### Important notes 91 | * input path are always case INSENSITIVE 92 | * content search on string (grep) are always case SENSITIVE 93 | * backslashes SHOULD NOT be escaped (except with regular expressions) 94 | For more informations, take a look at the [examples](./examples) 95 | 96 | ## About this project 97 | I initially created this project to automate fast system oriented IOC detection on a wide computer network. 98 | It fulfills the needs I have today. Nevertheless if you have complementary ideas, do not hesitate 99 | to ask for, I will see to implement them if they can be useful for everyone. 100 | On the other hand, pull request will be studied carefully. 101 | 102 | ## Future releases 103 | I don't plan to add any additional features right now. The next release will be focused on: 104 | * Unit testing / Code testing coverage / CI 105 | * Build more examples based on live malwares tradecraft and threat actor campaigns 106 | -------------------------------------------------------------------------------- /README.windows-compilation.md: -------------------------------------------------------------------------------- 1 | # Compiling instruction for _FastFinder_ on Windows 2 | 3 | _FastFinder_ was originally designed for Windows platform but it's a little bit tricky to compile because it's strongly dependant of go-yara and CGO. Here's a little step by step guide: 4 | 5 | ## Before installation 6 | 7 | All the installation process will be done with msys2/mingw terminal. In order to avoid any error, you have to ensure that your installation directories don't contains space or special characters. I haven't tested to install as a simple user, I strongly advise you to install everything with admin privileges on top of your c:\ drive. 8 | 9 | For the configurations and examples below, my install paths are: 10 | 11 | * GO: c:\Go 12 | * GOPATH: C:\Users\myuser\go 13 | * Msys2: c:\msys64 14 | * Git: c:\Git 15 | 16 | ## Install msys2 and dependencies: 17 | 18 | First of all, note that you won't be able to get _FastFinder_ working if the dependencies are compiled with another compiler than GCC. There is currently some problems with CGO when external libraries are compiled with Visual C++, so no need to install Visual Studio or vcpkg. 19 | 20 | * Download msys2 [from the official website](https://www.msys2.org/) and install it 21 | * there, you will find two distincts binaries shorcut "MSYS2 MSYS" and "MSYS2 MinGW 64bits". Please launch this second one. 22 | * install dependencies with the following command line: `pacman -S mingw-w64-x86_64-toolchain mingw-w64-x86_64-pkg-config base-devel openssl-devel` 23 | * add environment variables in mingw terminal: `export PATH=$PATH:/c/Go/bin:/c/msys64/mingw64/bin:/c/Git/bin` 24 | 25 | ## Download and compile libyara 26 | 27 | It's strongly advised NOT to clone VirusTotal's YARA repository but to download the source code of the latest release. If you compile libyara from the latest commit, it could generate some side effects when linking this library with _FastFinder_ and GCO. 28 | 29 | * download latest VirusTotal release source code [from here](https://github.com/VirusTotal/yara/releases) 30 | * unzip the folder in a directory without space and special char 31 | * in mingw terminal, go to yara directory (backslash have to be replace with slash eg. cd c:/yara) 32 | * compile and install using the following command: `./bootstrap.sh &&./configure && make && make install` 33 | 34 | ## Configure your OS 35 | 36 | With this step, you won't need to use mingw terminal anymore and you will be able to use Go to install _FastFinder_ and compile your projects directly from Windows cmd / powershell. 37 | 38 | Make sure you have the following as system environment variables (not user env vars). If not, create them: 39 | ``` 40 | GOARCH= (eg. amd64) 41 | GOOS=windows 42 | CGO_CFLAGS=-IC:/msys64/mingw64/include 43 | CGO_LDFLAGS=-LC:/msys64/mingw64/lib -lyara -lcrypto 44 | PKG_CONFIG_PATH=C:/msys64/mingw64/lib/pkgconfig 45 | ``` 46 | You also need C:\msys64\mingw64\bin in your system PATH env vars. 47 | 48 | Make sure you have got the following user environment var (not system var): 49 | 50 | GOPATH=%USERPROFILE%\go 51 | 52 | Note that paths must be written with slashs and not backslash. As already said, don't use path with spaces or special characters. 53 | 54 | ## Download, Install and compile FastFinder 55 | Now, from Windows cmd or Powershell, you can install _FastFinder_: `go get github.com/codeyourweb/fastfinder` 56 | Compilation should be done with: `go build -tags yara_static -a -ldflags '-extldflags "-static"' .` 57 | -------------------------------------------------------------------------------- /configuration.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "bytes" 5 | "fmt" 6 | "io/ioutil" 7 | "net/http" 8 | "regexp" 9 | "strings" 10 | 11 | "gopkg.in/yaml.v3" 12 | ) 13 | 14 | type ConfigurationObject struct { 15 | Line int 16 | 17 | Configuration 18 | } 19 | 20 | type Configuration struct { 21 | Input Input `yaml:"input"` 22 | Options Options `yaml:"options"` 23 | Output Output `yaml:"output"` 24 | AdvancedParameters AdvancedParameters `yaml:"advancedparameters"` 25 | } 26 | 27 | type Input struct { 28 | Path []string `yaml:"path"` 29 | Content Content `yaml:"content"` 30 | } 31 | 32 | type Content struct { 33 | Grep []string `yaml:"grep"` 34 | Yara []string `yaml:"yara"` 35 | Checksum []string `yaml:"checksum"` 36 | } 37 | 38 | type Options struct { 39 | ContentMatchDependsOnPathMatch bool `yaml:"contentMatchDependsOnPathMatch"` 40 | FindInHardDrives bool `yaml:"findInHardDrives"` 41 | FindInRemovableDrives bool `yaml:"findInRemovableDrives"` 42 | FindInNetworkDrives bool `yaml:"findInNetworkDrives"` 43 | FindInCDRomDrives bool `yaml:"findInCDRomDrives"` 44 | } 45 | 46 | type Output struct { 47 | Base64Files bool `yaml:"base64Files"` 48 | FilesCopyPath string `yaml:"filesCopyPath"` 49 | CopyMatchingFiles bool `yaml:"copyMatchingFiles"` 50 | } 51 | 52 | type AdvancedParameters struct { 53 | YaraRC4Key string `yaml:"yaraRC4Key"` 54 | MaxScanFilesize int `yaml:"maxScanFilesize"` 55 | CleanMemoryIfFileGreaterThanSize int `yaml:"cleanMemoryIfFileGreaterThanSize"` 56 | } 57 | 58 | func (i *ConfigurationObject) UnmarshalYAML(value *yaml.Node) error { 59 | err := value.Decode(&i.Configuration) 60 | if err != nil { 61 | return err 62 | } 63 | 64 | i.Line = value.Line 65 | 66 | return nil 67 | } 68 | 69 | func (c *Configuration) getConfiguration(configFile string) *Configuration { 70 | var yamlContent []byte 71 | var err error 72 | configFile = strings.TrimSpace(configFile) 73 | 74 | // configuration reading 75 | if IsValidUrl(configFile) { 76 | response, err := http.Get(configFile) 77 | if err != nil { 78 | LogFatal(fmt.Sprintf("Configuration file URL unreachable %v", err)) 79 | } 80 | yamlContent, err = ioutil.ReadAll(response.Body) 81 | if err != nil { 82 | LogFatal(fmt.Sprintf("Configuration file URL content unreadable %v", err)) 83 | } 84 | response.Body.Close() 85 | } else { 86 | yamlContent, err = ioutil.ReadFile(configFile) 87 | if err != nil { 88 | LogFatal(fmt.Sprintf("Configuration file reading error %v ", err)) 89 | } 90 | } 91 | 92 | // ciphered yaml file 93 | if !bytes.Contains(yamlContent, []byte("input")) { 94 | yamlContent = RC4Cipher(yamlContent, BUILDER_RC4_KEY) 95 | } 96 | 97 | var o ConfigurationObject 98 | err = yaml.Unmarshal(yamlContent, &o) 99 | 100 | if err != nil { 101 | LogFatal(fmt.Sprintf("%s - %v", configFile, err)) 102 | } 103 | 104 | *c = o.Configuration 105 | 106 | // check for specific user configuration params inconsistencies 107 | if len(c.Input.Path) == 0 || (len(c.Input.Content.Grep) == 0 && len(c.Input.Content.Yara) == 0 && len(c.Input.Content.Checksum) == 0) { 108 | c.Options.ContentMatchDependsOnPathMatch = false 109 | } 110 | 111 | if !c.Output.CopyMatchingFiles { 112 | c.Output.Base64Files = false 113 | c.Output.FilesCopyPath = "" 114 | } 115 | 116 | // check for missing advanced parameters 117 | if c.AdvancedParameters.MaxScanFilesize == 0 { 118 | c.AdvancedParameters.MaxScanFilesize = 2048 119 | } 120 | 121 | if c.AdvancedParameters.CleanMemoryIfFileGreaterThanSize == 0 { 122 | c.AdvancedParameters.CleanMemoryIfFileGreaterThanSize = 512 123 | } 124 | 125 | // parsing input paths 126 | environmentVariables := GetEnvironmentVariables() 127 | 128 | for i := 0; i < len(c.Input.Path); i++ { 129 | // replace environment variables 130 | for _, env := range environmentVariables { 131 | if strings.Contains(strings.ToLower(c.Input.Path[i]), "%"+strings.ToLower(env.Name)+"%") { 132 | c.Input.Path[i] = strings.Replace(c.Input.Path[i], "%"+env.Name+"%", env.Value, -1) 133 | } 134 | } 135 | 136 | // handle regex and simple find strings 137 | if c.Input.Path[i][0] != '/' || c.Input.Path[i][len(c.Input.Path[i])-1] != '/' { 138 | c.Input.Path[i] = regexp.QuoteMeta(strings.ToLower(c.Input.Path[i])) 139 | // use regular expression ".+" for "*" search pattern 140 | if strings.Contains(strings.ToLower(c.Input.Path[i]), "\\*") { 141 | c.Input.Path[i] = strings.Replace(c.Input.Path[i], "\\*", "[^\\\\]+", -1) 142 | } 143 | 144 | if strings.Contains(strings.ToLower(c.Input.Path[i]), "\\\\[^\\\\]+") { 145 | c.Input.Path[i] = strings.Replace(c.Input.Path[i], "\\\\[^\\\\]+", "[^\\\\]+", -1) 146 | } 147 | 148 | if strings.Contains(strings.ToLower(c.Input.Path[i]), "\\?") { 149 | c.Input.Path[i] = strings.Replace(c.Input.Path[i], "\\?", ".", -1) 150 | } 151 | } else { 152 | c.Input.Path[i] = strings.Trim(c.Input.Path[i], "/") 153 | } 154 | 155 | } 156 | 157 | // normalize checksums 158 | for i := 0; i < len(c.Input.Content.Checksum); i++ { 159 | c.Input.Content.Checksum[i] = strings.ToLower(c.Input.Content.Checksum[i]) 160 | } 161 | 162 | return c 163 | } 164 | -------------------------------------------------------------------------------- /examples/CISA-AA21-259A/CISA-AA21-259A.yaml: -------------------------------------------------------------------------------- 1 | # APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus (CVE-2021-40539) 2 | # search for: 3 | # - msiexec.exe in "MagageEngine" directory or subdirectory 4 | # - OR *.bat file in %PUBLIC% directory 5 | # - OR any file starting by "custom." in %PUBLIC% directory 6 | # - OR any file matching one of the two specified yara rules 7 | # - OR any file matching one of the specified sha256 hash 8 | # reference: 9 | # - https://www.cisa.gov/uscert/ncas/alerts/aa21-259a 10 | # - https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/ 11 | input: 12 | path: 13 | - '/(?i)\\ManageEngine\\.+msiexec\.exe$/' 14 | - '%PUBLIC%\\*.bat' 15 | - '%PUBLIC%\custom\*' 16 | content: 17 | grep: [] 18 | yara: 19 | - 'EncryptJSP.yar' 20 | - 'ReportGenerate_jsp.yar' 21 | checksum: 22 | - '068d1b3813489e41116867729504c40019ff2b1fe32aab4716d429780e666324' 23 | - '49a6f77d380512b274baff4f78783f54cb962e2a8a5e238a453058a351fcfbba' 24 | - 'ecd8c9967b0127a12d6db61964a82970ee5d38f82618d5db4d8eddbb3b5726b7' 25 | - '67ee552d7c1d46885b91628c603f24b66a9755858e098748f7e7862a71baa015' 26 | options: 27 | contentMatchDependsOnPathMatch: false 28 | findInHardDrives: true 29 | findInRemovableDrives: false 30 | findInNetworkDrives: false 31 | findInCDRomDrives: false 32 | output: 33 | copyMatchingFiles: false 34 | base64Files: false 35 | filesCopyPath: '' -------------------------------------------------------------------------------- /examples/CISA-AA21-259A/EncryptJSP.yar: -------------------------------------------------------------------------------- 1 | rule EncryptJSP { 2 | strings: 3 | $s1 = "AEScrypt" 4 | $s2 = "AES/CBC/PKCS5Padding" 5 | $s3 = "SecretKeySpec" 6 | $s4 = "FileOutputStream" 7 | $s5 = "getParameter" 8 | $s6 = "new ProcessBuilder" 9 | $s7 = "new BufferedReader" 10 | $s8 = "readLine()" 11 | condition: 12 | filesize < 15KB and 6 of them 13 | } -------------------------------------------------------------------------------- /examples/CISA-AA21-259A/ReportGenerate_jsp.yar: -------------------------------------------------------------------------------- 1 | rule ReportGenerate_jsp { 2 | strings: 3 | $s1 = "decrypt(fpath)" 4 | $s2 = "decrypt(fcontext)" 5 | $s3 = "decrypt(commandEnc)" 6 | $s4 = "upload failed!" 7 | $s5 = "sevck" 8 | $s6 = "newid" 9 | condition: 10 | filesize < 15KB and 4 of them 11 | } -------------------------------------------------------------------------------- /examples/example_configuration_api_triage.yaml: -------------------------------------------------------------------------------- 1 | input: 2 | path: [] 3 | content: 4 | grep: [] 5 | yara: 6 | - './examples/example_windows_api_triage.yar' 7 | checksum: [] 8 | options: 9 | contentMatchDependsOnPathMatch: false 10 | findInHardDrives: true 11 | findInRemovableDrives: false 12 | findInNetworkDrives: false 13 | findInCDRomDrives: false 14 | output: 15 | copyMatchingFiles: false 16 | base64Files: false 17 | filesCopyPath: '' -------------------------------------------------------------------------------- /examples/example_configuration_distant.yaml: -------------------------------------------------------------------------------- 1 | input: 2 | path: 3 | - '*.exe' 4 | content: 5 | grep: [] 6 | yara: 7 | - 'https://bit.ly/3dKRPnF' 8 | checksum: [] 9 | options: 10 | contentMatchDependsOnPathMatch: true 11 | findInHardDrives: true 12 | findInRemovableDrives: false 13 | findInNetworkDrives: false 14 | findInCDRomDrives: false 15 | output: 16 | copyMatchingFiles: false 17 | base64Files: false 18 | filesCopyPath: '' -------------------------------------------------------------------------------- /examples/example_configuration_linux.yaml: -------------------------------------------------------------------------------- 1 | input: 2 | path: [] 3 | content: 4 | grep: [] 5 | yara: 6 | - './examples/example_rule_linux.yar' 7 | checksum: 8 | - 'bf1cde9c94c301cdc3b5486f2f3fe66b' 9 | - '41ba1bd49cb22466e422098d184bd4267ef9529e' 10 | - 'e875b1185577ff872fbaabde481cc196af03745c530403c8303f00fe35859bf7' 11 | options: 12 | contentMatchDependsOnPathMatch: false 13 | findInHardDrives: true 14 | findInRemovableDrives: false 15 | findInNetworkDrives: false 16 | findInCDRomDrives: false 17 | output: 18 | copyMatchingFiles: false 19 | base64Files: false 20 | filesCopyPath: '' 21 | -------------------------------------------------------------------------------- /examples/example_configuration_windows.yaml: -------------------------------------------------------------------------------- 1 | input: 2 | path: 3 | - '%APPDATA%\\*.exe' 4 | - 'TEMP\\*.exe' 5 | - 'Windows\SysWOW64\cm*.exe' 6 | - 'Windows\System32\notepad\*' 7 | - '/temp\\\{[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}\}\\\w+\.exe$/' 8 | content: 9 | grep: 10 | - 'fastfinder.exe' 11 | yara: 12 | - './examples/example_rule_windows.yar' 13 | checksum: 14 | - 'c4884dadc3680439e30bf48ae0ca7048' 15 | - '7A320D69E436911A9EAF676D8C2B6A22580BF79F' 16 | - 'A4AF9EF6E345B3B4EA50DDE672A986C14F9A195E407EBAC36B1652AACC10E3EE' 17 | options: 18 | contentMatchDependsOnPathMatch: false 19 | findInHardDrives: true 20 | findInRemovableDrives: false 21 | findInNetworkDrives: false 22 | findInCDRomDrives: false 23 | output: 24 | copyMatchingFiles: false 25 | base64Files: false 26 | filesCopyPath: '' -------------------------------------------------------------------------------- /examples/example_rule_linux.yar: -------------------------------------------------------------------------------- 1 | rule fastfinder_example{ 2 | meta: 3 | name = "fastfinder_example" 4 | description = "Example of fastfinder yara match (on legitimate linux 'more' binary)" 5 | reference = "https://github.com/codeyourweb/fastfinder" 6 | strings: 7 | $str1 = "GNU" 8 | $str3 = "--More--" 9 | $str4 = "file perusal filter for CRT viewing" 10 | $str5 = "Press 'h' for instructions" 11 | $op = { ba 05 00 00 00 31 ff 4? 8d 35 ?? ?? ?? ?? e8 ?? ?? ?? ?? 4? 89 ee 4? 89 c7 e8 ?? ?? ?? ?? ba 05 00 00 00 31 ff 4? 8d 35 ?? ?? ?? ?? e8 ?? ?? ?? ??} 12 | condition: 13 | uint16(0) == 0x457f and all of them 14 | } -------------------------------------------------------------------------------- /examples/example_rule_windows.yar: -------------------------------------------------------------------------------- 1 | rule fastfinder_example{ 2 | meta: 3 | name = "fastfinder_example" 4 | description = "Example of fastfinder yara match (on legitimate nslookup.exe)" 5 | reference = "https://github.com/codeyourweb/fastfinder" 6 | strings: 7 | $str1 = "nslookup.exe" wide ascii 8 | $str3 = "nslookup.pdb" 9 | $str4 = "getaddrinfo" 10 | $str5 = "/.nslookuprc" 11 | condition: 12 | uint16(0) == 0x5a4d and all of them 13 | } -------------------------------------------------------------------------------- /examples/linux-fontonlake/eset_fontonlake_linux.yaml: -------------------------------------------------------------------------------- 1 | # FontOnLake is a malware family utilizing well-designed custom modules that are constantly under 2 | # development It targets systems running Linux and provides remote access to those systems for its 3 | # operators, collects credentials, and serves as a proxy server Its presence is always accompanied by a 4 | #rootkit, which conceals its existence 5 | # 6 | # search for: 7 | # - one of the three specified file paths 8 | # - OR any file matching the specified sha1 hash 9 | # reference: 10 | # - https://www.welivesecurity.com/wp-content/uploads/2021/10/eset_fontonlake.pdf 11 | input: 12 | path: 13 | - '/lib/modules/\*/kernel/drivers/input/misc/ati_remote3.ko' 14 | - '/etc/sysconfig/modules/ati_remote3.modules' 15 | - '/tmp/.tmp_\*' 16 | content: 17 | grep: [] 18 | yara: [] 19 | checksum: 20 | - '1f52db8e3fc3040c017928f5ffd99d9fa4757bf8' 21 | - '771340752985dd8e84cf3843c9843ef7a76a39e7' 22 | - '27e868c0505144f0708170df701d7c1ae8e1faea' 23 | - '45e94abedad8c0044a43ff6d72a5c44c6abd9378' 24 | - '1829b0e34807765f2b254ea5514d7bb587aeca3f' 25 | - '8d6aca824d1a717ae908669e356e2d4bb6f857b0' 26 | - '38b09d690fafe81e964cbd45ec7cf20dcb296b4d' 27 | - '56556a53741111c04853a5e84744807eeadff63a' 28 | - 'fe26cb98aa1416a8b1f6ced4ac1b5400517257b2' 29 | - 'd4e0e38ec69cbb71475d8a22edb428c3e955a5ea' 30 | - '204046b3279b487863738ddb17cbb6718af2a83a' 31 | - '9c803d1e39f335f213f367a84d3df6150e5fe172' 32 | - 'bfcc4e6628b63c92bc46219937ea7582ea6fbb41' 33 | - '515cfb5cb760d3a1da31e9f906ea7f84f17c5136' 34 | - 'a9ed0837e3af698906b229ca28b988010bcd5dc1' 35 | - '56cb85675fe7a7896f0aa5365ff391ac376d9953' 36 | - '72c9c5ce50a38d0a2b9cef6adeab1008bff12496' 37 | - 'b439a503d68ad7164e0f32b03243a593312040f8' 38 | - 'e7bf0a35c2cd79a658615e312d35bbcff9782672' 39 | - '56580e7ba6bf26d878c538985a6dc62ca094cd04' 40 | - '49d4e5fcd3a3018a88f329ae47ef4c87c6a2d27a' 41 | - '74d44c2949da7d5164adec78801733680da8c110' 42 | - '74d755e8566340a752b1db603ef468253adab6bd' 43 | - 'e20f87497023e3454b5b1a22fe6c5a5501eae2cb' 44 | - '6f43c598cd9e63f550ff4e6ef51500e47d0211f3' 45 | options: 46 | contentMatchDependsOnPathMatch: false 47 | findInHardDrives: true 48 | findInRemovableDrives: false 49 | findInNetworkDrives: false 50 | findInCDRomDrives: false 51 | output: 52 | copyMatchingFiles: false 53 | base64Files: false 54 | filesCopyPath: '' -------------------------------------------------------------------------------- /examples/log4j_vuln_checker/config-log4j_vuln_checker.yaml: -------------------------------------------------------------------------------- 1 | # scan local Java software installations for known instances of vulnerable #log4j 1.x and 2.x versions 2 | # CVE-2019-17571, CVE-2021-44228 3 | input: 4 | path: 5 | - '*.jar' 6 | - '*.class' 7 | content: 8 | grep: [] 9 | yara: [] 10 | checksum: 11 | - '39a495034d37c7934b64a9aa686ea06b61df21aa222044cc50a47d6903ba1ca8' # log4j 2.0-rc1 JndiLookup.class 12 | - 'a03e538ed25eff6c4fe48aabc5514e5ee687542f29f2206256840e74ed59bcd2' # log4j 2.0-rc2 JndiLookup.class 13 | - '964fa0bf8c045097247fa0c973e0c167df08720409fd9e44546e0ceda3925f3e' # log4j 2.0.1 JndiLookup.class 14 | - '9626798cce6abd0f2ffef89f1a3d0092a60d34a837a02bbe571dbe00236a2c8c' # log4j 2.0.2 JndiLookup.class 15 | - 'fd6c63c11f7a6b52eff04be1de3477c9ddbbc925022f7216320e6db93f1b7d29' # log4j 2.0 JndiLookup.class 16 | - '03c77cca9aeff412f46eaf1c7425669e37008536dd52f1d6f088e80199e4aae7' # log4j 2.4-2.11.2 JndiManager$1.class 17 | - '1584b839cfceb33a372bb9e6f704dcea9701fa810a9ba1ad3961615a5b998c32' # log4j 2.7-2.8.1 JndiManager.class 18 | - '1fa92c00fa0b305b6bbe6e2ee4b012b588a906a20a05e135cbe64c9d77d676de' # log4j 2.12.0-2.12.1 JndiManager.class 19 | - '293d7e83d4197f0496855f40a7745cfcdd10026dc057dfc1816de57295be88a6' # log4j 2.9.0-2.11.2 JndiManager.class 20 | - '3bff6b3011112c0b5139a5c3aa5e698ab1531a2f130e86f9e4262dd6018916d7' # log4j 2.4-2.5 JndiManager.class 21 | - '547883afa0aa245321e6b1aaced24bc10d73d5af4974d951e2bd53b017e2d4ab' # log4j 2.14.0-2.14.1 JndiManager$JndiManagerFactory.class 22 | - '620a713d908ece7fb09b7d34c2b0461e1c366704da89ea20eb78b73116c77f23' # log4j 2.1-2.3 JndiManager$1.class 23 | - '632a69aef3bc5012f61093c3d9b92d6170fdc795711e9fed7f5388c36e3de03d' # log4j 2.8.2 JndiManager$JndiManagerFactory.class 24 | - '635ccd3aaa429f3fea31d84569a892b96a02c024c050460d360cc869bcf45840' # log4j 2.9.1-2.10.0 JndiManager$JndiManagerFactory.class 25 | - '6540d5695ddac8b0a343c2e91d58316cfdbfdc5b99c6f3f91bc381bc6f748246' # log4j 2.6-2.6.2 JndiManager.class 26 | - '764b06686dbe06e3d5f6d15891250ab04073a0d1c357d114b7365c70fa8a7407' # log4j 2.8.2 JndiManager.class 27 | - '77323460255818f4cbfe180141d6001bfb575b429e00a07cbceabd59adf334d6' # log4j 2.14.0-2.14.1 JndiManager.class 28 | - '8abaebc4d09926cd12b5269c781b64a7f5a57793c54dc1225976f02ba58343bf' # log4j 2.13.0-2.13.3 JndiManager$JndiManagerFactory.class 29 | - '914a64f23e2bcc1ae166af645a21f71f18ad6be8282001ec10b3e45b37064c99' # log4j 2.13.0-2.15.0 JndiManager$1.class 30 | - '91e58af100aface711700562b5002c5d397fb35d2a95d5704db41461ac1ad8fd' # log4j 2.1-2.3 JndiManager$JndiManagerFactory.class 31 | - 'ae950f9435c0ef3373d4030e7eff175ee11044e584b7f205b7a9804bbe795f9c' # log4j 2.1-2.3 JndiManager.class 32 | - 'aec7ea2daee4d6468db2df25597594957a06b945bcb778bbcd5acc46f17de665' # log4j 2.4-2.6.2 JndiManager$JndiManagerFactory.class 33 | - 'b8af4230b9fb6c79c5bf2e66a5de834bc0ebec4c462d6797258f5d87e356d64b' # log4j 2.7-2.8.1 JndiManager$JndiManagerFactory.class 34 | - 'c3e95da6542945c1a096b308bf65bbd7fcb96e3d201e5a2257d85d4dedc6a078' # log4j 2.13.0-2.13.3 JndiManager.class 35 | - 'e4906e06c4e7688b468524990d9bb6460d6ef31fe938e01561f3f93ab5ca25a6' # log4j 2.8.2-2.12.0 JndiManager$1.class 36 | - 'fe15a68ef8a75a3f9d3f5843f4b4a6db62d1145ef72937ed7d6d1bbcf8ec218f' # log4j 2.12.0-2.12.1 JndiManager$JndiManagerFactory.class 37 | - '6adb3617902180bdf9cbcfc08b5a11f3fac2b44ef1828131296ac41397435e3d' # log4j 1.2.4 SocketNode.class 38 | - '3ef93e9cb937295175b75182e42ba9a0aa94f9f8e295236c9eef914348efeef0' # log4j 1.2.6-1.2.9 SocketNode.class 39 | - 'bee4a5a70843a981e47207b476f1e705c21fc90cb70e95c3b40d04a2191f33e9' # log4j 1.2.8 SocketNode.class 40 | - '7b996623c05f1a25a57fb5b43c519c2ec02ec2e647c2b97b3407965af928c9a4' # log4j 1.2.15 SocketNode.class 41 | - '688a3dadfb1c0a08fb2a2885a356200eb74e7f0f26a197d358d74f2faf6e8f46' # log4j 1.2.16 SocketNode.class 42 | - '8ef0ebdfbf28ec14b2267e6004a8eea947b4411d3c30d228a7b48fae36431d74' # log4j 1.2.17 SocketNode.class 43 | - 'd778227b779f8f3a2850987e3cfe6020ca26c299037fdfa7e0ac8f81385963e6' # log4j 1.2.11 SocketNode.class 44 | - 'ed5d53deb29f737808521dd6284c2d7a873a59140e702295a80bd0f26988f53a' # log4j 1.2.5 SocketNode.class 45 | - 'f3b815a2b3c74851ff1b94e414c36f576fbcdf52b82b805b2e18322b3f5fc27c' # log4j 1.2.12 SocketNode.class 46 | - 'fbda3cfc5853ab4744b853398f2b3580505f5a7d67bfb200716ef6ae5be3c8b7' # log4j 1.2.13-1.2.14 SocketNode.class 47 | options: 48 | contentMatchDependsOnPathMatch: true 49 | findInHardDrives: true 50 | findInRemovableDrives: false 51 | findInNetworkDrives: false 52 | findInCDRomDrives: false 53 | output: 54 | copyMatchingFiles: false 55 | base64Files: false 56 | filesCopyPath: '' -------------------------------------------------------------------------------- /examples/proxyshell/drophell.yaml: -------------------------------------------------------------------------------- 1 | # Proxyshell exploitation - DropHell malware 2 | # search for: 3 | # - *.exe or *.aspx in a "ZING" directory or subdirectory 4 | # - OR aspx webshell in Page_Load function 5 | # - OR any of the specified sha256 hash 6 | # reference: 7 | # - https://twitter.com/DeepInstinctSec/status/1450129546125131780 8 | # - https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside 9 | # - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit 10 | input: 11 | path: 12 | - '/(?i)\\ZING\\.+(\.(exe)|(aspx))$/' 13 | content: 14 | grep: 15 | - '