Free / Community - Triage Analysis Tools - FireEye / Crowdstrike

Compromise Assessment / Triage Analysis Tools :

Two best tools to do the triage analysis , once the system is suspect for compromise. 

             

• Redline - FireEye

•  CrowdResponse - CrowdStrike

  
  

Redline:

           FireEye's premier free endpoint security tool, provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.

With Redline, you can:

• Thoroughly audit and collect all running processes and drivers from memory, file-system metadata, registry data, event logs, network information, services, tasks and web history.
• Analyze and view imported audit data, including the ability to filter results around a given timeframe using Redline’s Timeline functionality with the TimeWrinkle™ and TimeCrunch™ features.
• Streamline memory analysis with a proven workflow for analyzing malware based on relative priority.
• Perform Indicators of Compromise (IOC) analysis. Supplied with a set of IOCs, the Redline Portable Agent is automatically configured to gather the data required to perform the IOC analysis and an IOC hit result review.

Redline version 1.20.2 introduces support for large file and registry audits. Redline has also been improved to address issues related to efficiency and memory management.

• Supported Operating Systems: Windows XP, Windows Vista, Windows 7, Windows 8 (32-bit and 64-bit), Windows 10
• File Size: 76 MB
• Integrity Hashes:
  • MD5: 2edb1d0e023f286ea5015cdf1382d642
  • SHA-1: e38fe8cc81dc5491d38b61db0fff165cdd3ed35d
   

Download Link :

https://www.fireeye.com/content/dam/fireeye-www/services/freeware/sdl-redline.zip

CrowdResponse: 
                          Static Host Data Collection Tool.

                                    There is no installer for this tool. Simply unzip the contents of the downloaded ZIP file into a location of your choosing and launch it directly from there. Similarly for uninstalling; simply delete the file(s) you extracted by moving them to the Recycle Bin or permanently deleting them. It is possible there may be a very small number of elements that remain in the Registry.

There can be safely ignored or manually deleted by using a registry editing tool (e.g. regedit) and navigating to HKEY_LOCAL_MACHINE\Software\\CrowdStrike or HKEY_CURRENT_USER\Software\CrowdStrike and noting the name of the tool there and removing the branch.

Hashes:

• MD5 c94edf14e5e1b205813b949b7904b95e


• SHA1 bf48a7c0e32fd8f67b11eebb69f836a60de2f9e1


• SHA256 3b5f07d83af34f16f79f8cc1f77d6a0827d7dee57a4be8f667767ce325ac5d00

Download Link :

https://www.crowdstrike.com/wp-content/community-tools/CrowdResponse.zip

Free / Open Source Compromise Assessment Tools

OTX ( Open Threat Exchange ):

 

                                     AlienVault provides OTX Endpoint Threat Hunter and its free, fast, and simple.

AlienVault threat hunting service delivers as much threat intelligence power as OTX Endpoint Threat Hunter. It is the Open & free service that natively uses the community-powered threat intelligence of OTX to scan your endpoints for known indicators of compromise (IOCs).

OTX Endpoint Threat Hunter uses the same agent-based approach as expensive endpoint security tools and DIY open source agents without the expense, complexity, or guesswork. 

How It Works

• OTX Endpoint Threat Hunter is available to any registered Open Threat Exchange (OTX) user. It’s free to join OTX.
• To get started, download and install the AlienVault® Agent on the Windows or Linux devices you want to monitor. The AlienVault Agent is immediately ready to find threats.
• You can launch a query on any endpoint from OTX by selecting a pre-defined query that looks for IOCs in one or more OTX pulses.
• Once launched, the AlienVault Agent executes the query, and the results of the query display on a summary page within OTX.

Download Link : https://otx.alienvault.com/

CERTitude:

 

       is a Python-based tool which aims at assessing the compromised perimeter during incident response assignments. It allows analysts to perform large scale scans of Windows-based information systems by searching for behavioral patterns described in IOC (Indicator of Compromise) files. The tool is currently composed of two main components:

• The Python Flask-based web interface, used to configure the scans and visualize their results;
• The scanner that connects to remote targets and runs the search for IOCs.

CERTitude is an open-source tool developed by the CERT-Wavestone. It is brought to you freely, but user support is only provided on a best-effort basis.

Compatibility

CERTitude is compatible with a wide range of target Windows operating systems, from XP / 2003 to Windows 10 / Server 2016. Though CERTitude can be run from a Linux host, it is only fully supported on Windows as some features may not be implemented on Linux.

Features:

• Ability to scan hosts in a way that prevents the target workstation from knowing what the investigator is searching for
• Ability to retrieve some pieces of data from the hosts
• Multiple scanner instances (for IOCs and/or hash scans) can be run at the same time for parallel scanning
• Built with security considerations in mind (protected database, secure communications with hosts using IPSec)

 Download Link: https://github.com/cert-w/certitude