diff --git a/README.md b/README.md index 91e191f..05f3ce9 100644 --- a/README.md +++ b/README.md @@ -2,16 +2,16 @@ Public tools, scripts or code snippets that can help when working with our products -## ASGARD +## Management Center -### Bulk License Generator for ASGARD v2 +### Bulk License Generator for Management Center v2 -Written for: ASGARD v2 +Written for: Management Center v2 Language: Windows Batch -A Windows Batch files that allows you to generate and retrieve licenses for a list of hosts from a remote ASGARD v2 system. +A Windows Batch files that allows you to generate and retrieve licenses for a list of hosts from a remote Management Center v2 system. -## ASGARD Analysis Cockpit +## Analysis Cockpit ### THOR Timestamp Converter @@ -24,7 +24,7 @@ The converter allows you to convert the timestamp of old THOR logs to the new RF ### THOR Seed -Written for: THOR, ASGARD v3, Nextron Portal (referenced as "THOR Cloud" in the script) +Written for: THOR, Management Center v3, Nextron Portal (referenced as "THOR Cloud" in the script) Language: PowerShell THOR Seed is a lightweight PowerShell script that facilitates the deployment of THOR in cases in which you can't or don't want to use an agent for a continous compromise assessment. diff --git a/asgard/asgard-bulk-lic-generator.bat b/management-center/mgmt-bulk-lic-generator.bat similarity index 71% rename from asgard/asgard-bulk-lic-generator.bat rename to management-center/mgmt-bulk-lic-generator.bat index 17fcad9..f7f765e 100644 --- a/asgard/asgard-bulk-lic-generator.bat +++ b/management-center/mgmt-bulk-lic-generator.bat @@ -2,17 +2,17 @@ SETLOCAL EnableDelayedExpansion REM Configuration -SET ASGARD_HOST=asgard.nextron-systems.com +SET MGMTCNT_HOST=mgmt-center.nextron-systems.com SET API_KEY="not set" -ECHO ============================================= -ECHO Bulk License Generator for ASGARD v2 +ECHO ================================================ +ECHO Bulk License Generator for Management Center v2 ECHO Florian Roth v1.0, Win10 Version using Curl -ECHO ============================================= +ECHO ================================================ ECHO. IF %API_KEY% == "not set" ( - ECHO Error: No API key set. Open this batch file with a text editor and set your asgard host and api key in the configurtaion section. You can find your API Key in User Settings > API Key. + ECHO Error: No API key set. Open this batch file with a text editor and set your management center host and api key in the configuration section. You can find your API Key in User Settings > API Key. EXIT /b 1 ) @@ -29,7 +29,7 @@ IF NOT EXIST %CD%\hostnames.txt ( FOR /F "tokens=*" %%A in (%CD%\hostnames.txt) DO ( ECHO Generating license for %%A ... - curl -X POST "https://%ASGARD_HOST%:8443/api/v0/licensing/issue" ^ + curl -X POST "https://%MGMTCNT_HOST%:8443/api/v0/licensing/issue" ^ -H "accept: application/octet-stream" ^ -H "Authorization: %API_KEY%" ^ -H "Content-Type: application/x-www-form-urlencoded" ^ diff --git a/asgard/asgard-license-gen.ps1 b/management-center/mgmt-license-gen.ps1 similarity index 86% rename from asgard/asgard-license-gen.ps1 rename to management-center/mgmt-license-gen.ps1 index 1eed031..f48612a 100644 --- a/asgard/asgard-license-gen.ps1 +++ b/management-center/mgmt-license-gen.ps1 @@ -1,8 +1,8 @@ # License retrieval script # Florian Roth, June 2021 -# ASGARD URL -$AsgardURL = "https://asgard.nextron-systems.com:8443/api/v0/licensing/issue" +# Management Center URL +$MgmtCntURL = "https://mgmt-center.nextron-systems.com:8443/api/v0/licensing/issue" $Token = "" $LicenseFile = "licenses.zip" $OutputPath = ".\" @@ -18,9 +18,9 @@ $ExtractLicenses = $True [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $WebClient = New-Object System.Net.WebClient if ( $Token ) { - $AsgardURL = [string]::Format("{0}?token={1}", $AsgardURL, $Token) + $MgmtCntURL = [string]::Format("{0}?token={1}", $MgmtCntURL, $Token) } -Write-Host "Using URL: $AsgardURL" +Write-Host "Using URL: $MgmtCntURL" # Hostname $Hostname = $env:COMPUTERNAME @@ -44,7 +44,7 @@ Write-Host "Requesting license for HOST: $Hostname TYPE: $LicenseType" # Request license try { - $Response = $WebClient.UploadValues($AsgardURL, $postData) + $Response = $WebClient.UploadValues($MgmtCntURL, $postData) # HTTP Errors } catch [System.Net.WebException] { Write-Host "The following error occurred: $_" diff --git a/thor-help/README.md b/thor-help/README.md index 4e7e0aa..6e47dbc 100644 --- a/thor-help/README.md +++ b/thor-help/README.md @@ -1,335 +1,6 @@ -## Scan Options +## This page has been moved -```help - -t, --template string Process default scan parameters from this YAML file - --generate-config Print a YAML config from the given parameters and exit - -p, --path strings Scan a specific file path. Define multiple paths by specifying this option multiple times. Append ':NOWALK' to the path for non-recursive scanning (default: only the system drive) (default []) - --allhds (Windows Only) Scan all local hard drives (default: only the system drive) - --alldrives Scan all local drives, including network drives (default: only the system drive). Requires a Forensic Lab license. - --max_file_size uint Max. file size to check (larger files are ignored). Increasing this limit will also increase memory usage of THOR. (default 30MB) - --max_log_lines int Maximum amount of lines to check in a log file before skipping the remaining lines (default 1000000) - --max_process_size uint Max process size to check (larger processes won't be scanned) (default 2GB) - --max_runtime int Maximum runtime in hours. THOR will stop once this time has run out. 0 means no maximum runtime. (default 168) - --nodoublecheck Don't check whether another THOR instance is running (e.g. in Lab use cases when several mounted images are scanned simultaneously on a single system) (requires a Forensic Lab license) - -f, --epoch strings Specify a range of days with attacker activity as start and end date pairs. - Files created/modified between these days (including the specified start, excluding the specified end) will receive an extra score. - Example: -f 2009-10-09 -f 2009-10-10 marks the 09.10.2009 as relevant. (default []) - --epochscore int Score to add for files that were created/modified on days with attacker activity (see --epoch parameter) (default 35) - --insecure Skip TLS host verification (insecure) - --ca strings Root CA for host certificate verification during TLS handshakes (default []) - --cross-platform Apply IOCs with path separators platform independently. - --require-admin Terminate immediately if THOR is executed without administrator rights. - --follow-symlinks When encountering a symlink during the file scan that points to a directory, scan the directory. - --max-recursion-depth uint Maximum depth of archives to scan (default 4) - --max-nested-objects uint Maximum number of files per archive to scan (default 10000) -``` +For the full list of THOR Command Line arguments, please +visit the Manual: -## Scan Modes - -```help - --quick Activate a number of flags to speed up the scan at cost of some detection. - This is equivalent to: --noeventlog --nofirewall --noprofiles --nologscan --noevtx --nohotfixes --nomft --lookback 3 --lookback-modules filescan - --soft Skip CPU and RAM intensive modules (Mutexes, Firewall, Logons, Network sessions and shares, LSA sessions, open files, hosts file), don't decompress executables and doesn't perform a DoublePulsar backdoor check, lower max CPU usage to 70% and set low priority for THOR. - This mode activates automatically on systems with 1 CPU core or less than 1024 MB RAM. - --intense Paranoid scan mode that disables all safe guards. Only use this mode in lab scanning scenarios. We don't recommend using this mode to live scan productive systems. (enables: memory intensive extra modules) - --diff Set lookback time (see --lookback) for each module to the last time the module ran successfully and activates --global-lookback. - Effectively, this means that only elements that changed since the last scan are examined. (only works if ThorDB has been active) - --lookback int Specify how many past days shall be analyzed. Event log entries from before this point will be ignored. 0 means no limit (default 0). - --global-lookback Apply Lookback to all modules that support it (not only Eventlog). See also --lookback and --lookback-modules. - Warning: Timestomping or similar methods of antivirus evasion may result in elements not being examined. - --force-aptdir-lookback Enforce lookback application on all files in the FileScan module. By default, especially endangered directories ignore the lookback value. - --lookback-modules strings Apply Lookback to the given modules. See also --lookback and --modules. - Warning: Timestomping or similar methods of antivirus evasion may result in elements not being examined. (default []) - --lab Lab scan mode - scan only the file system, disable resource checks and quick mode, activate intense mode, disable ThorDB, apply IOCs platform independently and use all CPU cores. - This option scans all drives by default, but is often used with -p to scan only a single path. Requires a Forensic Lab license. - --virtual-map strings Rewrite found file paths to use a different prefix. - This can be useful for mounted images, where the current location of files does not match the original location and therefore references might be out of date. - Specify the original and current path as --virtual-map path/to/current/location:path/to/original/location. - On Windows, drive names are also supported, e.g. specify --virtual-map F:C if the drive on F: was originally used as C:. - Requires a Forensic Lab license. (default []) -``` - -## Resource Options - -```help - -c, --cpulimit float Limit CPU usage of THOR to this level (in percent). Minimum is 15% (default 95) - --nocpulimit Disable cpulimit check - --nosoft Disable automatic activation of soft mode (see --soft) - --norescontrol Do not check whether the system is running out of resources. Use this option to enforce scans that have been canceled due to resource scarcity. (use with care!) - --minmem uint Cancel the running scan if the amount of free physical memory drops below this value (in MB) (default 50) - --lowprio Reduce the priority of the THOR process to a lower level - --verylowprio Reduce the priority of the THOR process to a very low level - --lowioprio Reduce the disk priority of the THOR process to a lower level - --nolowprio Do not reduce the priority of the THOR process to a lower level due to soft mode (see --soft) - --nolockthread Do not lock calls to C libraries to main thread (this may increase performance at the cost of memory usage) - --yara-stack-size int Allocate this number of slots for the YARA stack. Increasing this limit will allow you to use larger rules, albeit with more memory overhead. (default 32768) - --yara-timeout int Cancel any YARA checks that take longer this amount of time (in seconds) (default 90) - --threads uint16 Run this amount of THOR threads in parallel. Requires a Forensic Lab license. - --bulk-size uint Check this amount of elements together, e.g. log lines or registry entries (default 20MB) -``` - -## Special Scan Modes - -```help - -m, --image_file string Scan only the given single memory image / dump file (don't use for disk images, scan them mounted with --lab). Requires a Forensic Lab license. - --image-chunk-size uint Scan image / dump files in chunks of this size (default 11MB) - -r, --restore_directory string Restore PE files with YARA rule matches during the DeepDive into the given folder - --restore_score int Restore only chunks with a total match score higher than the given value (default 50) - --dropzone Watch and scan all files dropped to a certain directory (which must be passed with -p). Disable resource checks and quick mode, activate intense mode, disable ThorDB and apply IOCs platform independently. Requires a Forensic Lab license. - --dropdelete Delete all files dropped to the drop zone after the scan. -``` - -## Thor Thunderstorm Service - -```help - --thunderstorm Watch and scan all files sent to a specific port (see --server-port). Disable resource checks and quick mode, activate intense mode, disable ThorDB and apply IOCs platform independently. - --server-upload-dir string Path to a directory where THOR drops uploaded files. - If this path does not exist, THOR tries to create it. (default "/var/folders/wf/74mtjd112gdbybts4zwt0d0m0000gn/T/thor-uploads") - --server-host string IP address that THOR's server should bind to. (default "127.0.0.1") - --server-port uint16 TCP port that THOR's server should bind to. (default 8080) - --server-cert string TLS certificate that THOR's server should use. If left empty, TLS is not used. - --server-key string Private key for the TLS certificate that THOR's server should use. Required if --server-cert is specified. - --server-store-samples string Sets whether samples should be stored permanently in the folder specified with --server-upload-dir. - Specify "all" to store all samples, or "malicious" to store only samples that generated a warning or an alert. (default "none") - --server-result-cache-size uint32 Size of the cache that is used to store results of asynchronous requests temporarily. - If set to 0, the cache is disabled and asynchronous results are not stored. (default 250000) - --pure-yara Only scan files using YARA signatures (disables all programmatic checks, STIX, Sigma, IOCs, as well as most features and modules) - --sync-only-threads uint16 Reserve this amount of THOR threads for synchronous requests - --force-max-file-size Enforce the maximum file size even on files like registry hives or log files which are usually scanned despite size. -``` - -## License Retrieval - -```help - --asgard string Hostname of the ASGARD server from which a license should be requested, e.g. asgard.my-company.internal - --asgard-token string Use this token to authenticate with the License API of the asgard server. The token can be found in the 'Downloads' or 'Licensing' section in the ASGARD. This requires ASGARD 2.5+. - -q, --license-path string Path containing the THOR license (default is application directory) - --portal-key string Get a license for this host from portal.nextron-systems.com using this API Key. - This feature is only supported for host-based server / workstation contracts. - --portal-contracts ints Use these contracts for license generation. If no contract is specified, the portal selects a contract by itself. See --portal-key. (default []) - --portal-nonewlic Only use an existing license from the portal. If none exists, exit. See --portal-key. -``` - -## Active Modules - -```help -Available modules: DeepDive, EnvCheck, Filescan, Hosts, LoggedIn, UserDir, Timestomp, Autoruns, KnowledgeDB, Dropzone, ProcessCheck, Thunderstorm, Users - -a, --module strings Activate the following modules only (Specify multiple modules with -a Module1 -a Module2 ... -a ModuleN). (default []) - --noprocs Do not analyze Processes - --nofilesystem Do not scan the file system - --noreg Do not analyze the registry - --nousers Do not analyze user accounts - --nologons Do not show currently logged in users - --noautoruns Do not analyse autorun elements - --noeventlog Do not analyse the eventlog - --norootkits Do not check for rootkits - --noevents Do not check for malicious events - --nodnscache Do not analyze the local DNS cache - --noenv Do not analyze environment variables - --nohosts Do not analyze the hosts file - --nomutex Do not check for malicious mutexes - --notasks Do not analyse scheduled tasks - --noservices Do not analyze services - --noprofiles Do not analyze profile directories - --noatjobs Do not analyze jobs scheduled with the 'at' tool - --nonetworksessions Do not analyze network sessions - --nonetworkshares Do not analyze network shares - --noshimcache Do not analyze SHIM Cache entries - --nohotfixes Do not analyze Hotfixes - --nowmistartup Do not analyze startup elements using WMI - --nofirewall Do not analyze the local Firewall - --nowmi Disable all checks with WMI functions - --nolsasessions Do not analyze lsa sessions - --nomft Do not analyze the drive's MFT (default, unless in intense mode) - --mft Analyze the drive's MFT - --nopipes Do not analyze named pipes - --noetwwatcher Do not analyze ETW logs during THOR runtime - --nointegritycheck Do not check with the package manager for package integrity on Linux - --notimestomp Disable timestomping detection -``` - -## Module Extras - -```help - --process ints Process IDs to be scanned. Define multiple processes by specifying this option multiple times (default: all processes) (Module: ProcessCheck) (default []) - --dump-procs Generate process dumps for suspicious or malicious processes (Module: ProcessCheck) - --max-procdumps uint Create at most this many process dumps (Module: ProcessCheck) (default 10) - --procdump-dir string Store process dumps of suspicious processes in this directory (Module: ProcessCheck) (default "/var/lib/thor") - -n, --eventlog-target strings Scan specific Eventlogs (e.g. 'Security' or 'Microsoft-Windows-Sysmon/Operational') (Module: Eventlog) (default []) - --nodoublepulsar Do not check for DoublePulsar Backdoor (Module: Rootkit) - --full-registry Do not skip registry hives keys with less relevance (Module: Registry) - --noregwalk Do not scan the whole registry during the registry scan - --showdeleted Show deleted files found in the MFT as 'info' messages. - --allfiles Scan all files, even ones that are usually not interesting. Sets --max_file_size to 200MB unless specified otherwise. - --ads Scan Alternate Data Streams for all files -``` - -## Active Features - -```help - --nothordb Do not use or create ThorDB database for holding scan information - --nosigma Disable Sigma signatures - --dumpscan Scan memory dumps - --nologscan Do not scan log files (identified by .log extension or location) - --noyara Disable checks with YARA - --nostix Disable checks with STIX - --noarchive Do not scan contents of archives - --noc2 Disable checks for known C2 Domains - --noprochandles Do not analyze process handles - --noprocconnections Do not analyze process connections - --noamcache Do not analyze Amcache files - --noregistryhive Do not analyze Registry Hive files - --noexedecompress Do not decompress and scan portable executables - --nowebdirscan Do not analyze web directories that were found in process handles - --novulnerabilitycheck Do not analyze system for vulnerabilities - --noprefetch Do not analyze prefetch directory - --nogroupsxml Do not analyze groups.xml - --nowmipersistence Do not check WMI Persistence - --nolnk Do not analyze LNK files - --noknowledgedb Do not check Knowledge DB on Mac OS - --nower Do not analyze .wer files - --noevtx Do not analyze EVTX files - --noauthorizedkeys Do not analyze authorized_keys files - --noimphash Do not calculate imphash for suspicious EXE files (Windows only) - --c2-in-memory Apply C2 IOCs on process memory (not recommended unless you are willing to accept many false positives on browser and other process memories) - --custom-c2-in-memory Apply custom C2 IOCs on process memory - --noeml Disable Email parser - --noetl Disable ETL parser -``` - -## Feature Extras - -```help - --customonly Use custom signatures only (disables all internal THOR signatures and detections) - --full-proc-integrity Increase sensitivity of --processintegrity for process impersonation detection. Likely to cause false positives, but also better at detecting real threats. - --processintegrity Run PE-Sieve to check for process integrity (Windows only) -``` - -## Output Options - -```help - -l, --logfile string Log file for text output (default ":hostname:_thor_:time:.txt") - --htmlfile string Log file for HTML output (default ":hostname:_thor_:time:.html") - --nolog Do not generate text or HTML log files - --nohtml Do not create an HTML report file - --appendlog Append text log to existing log instead of overwriting - --keyval Format text and HTML log files with key value pairs to simplify the field extraction in SIEM systems (key='value') - --jsonfile string[=":hostname:_thor_:time:.json"] Log file for JSON output. If no value is specified, defaults to :hostname:_thor_:time:.json. - --jsonv2 Print JSON logs in the v2 format, which is easier to parse than the old v1 format - -o, --csvfile string Generate a CSV containing MD5,Filepath,Score for all files with at least the minimum score (default ":hostname:_files_md5s.csv") - --nocsv Do not write a CSV of all mentioned files with MD5 hash (see --csvfile) - --stats-file string[=":hostname:_stats.csv"] Generate a CSV file containing the scan summary in a single line. If no value is specified, defaults to :hostname:_stats.csv. - -e, --rebase-dir string Specify the output directory where all output files will be written. Defaults to the current working directory. - --suppresspi Suppress all personal information in log outputs to comply with local data protection policies - --eventlog Log to windows application eventlog - -x, --min int Only report files with at least this score (default 40) - --allreasons Show all reasons why a match is considered dangerous (default: only the top 2 reasons are displayed) - --printshim Include all SHIM cache entries in the output as 'info' level messages - --printamcache Include all AmCache entries in the output as 'info' level messages - -j, --overwrite-hostname string Override the local hostname value with a static value (useful when scanning mounted images in the lab. Requires a Forensic Lab license. (default "prometheus.local") - -i, --scanid string Specify a scan identifier (useful to filter on the scan ID, should be unique) - --scanid-prefix string Specify a prefix for the scan ID that is concatenated with a random ID if neither --scanid nor --noscanid are specified (default "S-") - --noscanid Do not automatically generate a scan identifier if none is specified - --silent Do not print anything to command line - --cmdjson Format command line output as JSON - --cmdkeyval Use key-value pairs for command line output, see --keyval - --encrypt Encrypt the generated log files and the MD5 csv file - --pubkey string Use this RSA public key to encrypt the logfile and csvfile (see --encrypt). Both --pubkey="" and --pubkey="" are supported. - --nocolor Do not use ANSI escape sequences for colorized command line output - --genid Print a unique ID for each log message. Identical log messages will have the same ID. - --print-rescontrol Print THOR's resource threshold and usage when it is checked - --truncate int Max. length per THOR value (0 = no truncation) (default 2048) - --registry_depth_print int Don't print info messages when traversing registry keys at a higher depth than this (default 1) - --utc Print timestamps in UTC instead of local time zone - --rfc3339 Print timestamps in RFC3339 (YYYY-MM-DD'T'HH:mm:ss'Z') format - --reduced Reduced output mode - only warnings, alerts and errors will be printed - --printlicenses Print all licenses to command line (default: only 10 licenses will be printed) - --local-syslog Print THOR events to local syslog - --showall Print rule matches even if that rule already matched more than 10 times. - --ascii Don't print non-ASCII characters to command line and log files - --string-context uint When printing strings from YARA matches, include this many bytes surrounding the match (default 50) - --include-info-in-html Include info messages in the HTML report - --audit-trail string Output file for audit trail - --background string Optimize font colors for given terminal background (options: default, light, dark) (default "default") -``` - -## ThorDB - -```help - --dbfile string Location of the thor.db file (default "/var/lib/thor/thor10.db") - --resumeonly Don't start a new scan, only finish an interrupted one. If no interrupted scan exists, nothing is done. - --resume Store information while running that allows to resume an interrupted scan later. If a previous scan was interrupted, resume it instead of starting a new one. -``` - -## Syslog - -```help - -s, --syslog strings Write output to the specified syslog server, format: server[:port[:syslogtype[:sockettype]]]. - Supported syslog types: DEFAULT/CEF/JSON/SYSLOGJSON/SYSLOGKV - Supported socket types: UDP/TCP/TCPTLS - Examples: -s syslog1.dom.net, -s arcsight.dom.net:514:CEF:UDP, -s syslog2:4514:DEFAULT:TCP, -s syslog3:514:JSON:TCPTLS (default []) - --rfc3164 Truncate long Syslog messages to 1024 bytes - --rfc5424 Truncate long Syslog messages to 2048 bytes - --rfc Use strict syslog according to RFC 3164 (simple host name, shortened message) - --maxsysloglength int Truncate Syslog messages to the given length (0 means no truncation) (default 2048) - --cef_level int Define the minimum severity level to log to CEF syslogs (Debug=1, Info=3, Notice=4, Error=5, Warning=8, Alarm=10) (default 4) -``` - -## Reporting and Actions - -```help - --notice int Minimum score on which a notice is generated (default 40) - --warning int Minimum score on which a warning is generated (default 60) - --alert int Minimum score on which an alert is generated (default 81) - --action_command string Run this command for each file that has a score greater than the score from --action_level. - --action_args strings Arguments to pass to the command specified via --action_command. - The placeholders %filename%, %filepath%, %file%, %ext%, %md5%, %score% and %date% are replaced at execution time. (default []) - --action_level int Only run the command from --action_command for files with at least this score. (default 40) - --nofserrors Silently ignore filesystem errors - --minimum-sigma-level string Only report sigma rule matches with this level or higher (default "high") -``` - -## THOR Remote - -```help - --remote strings Target host (use multiple --remote statements for a set of hosts) (default []) - --remote-user string Username (if not specified, windows integrated authentication is used) - --remote-password string Password to be used to authenticate against remote hosts - --remote-prompt Prompt for password for remote hosts - --remote-debug Debug Mode for THOR Remote - --remote-dir string Upload THOR to this remote directory - --remote-workers int Number of concurrent scans (default 25) - --remote-rate int Number of seconds to wait between scan starts (default 30) -``` - -## Automatic Collection of Suspicious Files (Bifrost) - -```help - --bifrost2Server string Server running the Bifrost 2 quarantine service. THOR will upload all suspicious files to this server. - This flag is only usable when invoking THOR from ASGARD 2. - --bifrost2Score int Send all files with at least this score to the Bifrost 2 quarantine service. - This flag is only usable when invoking THOR from ASGARD 2. (default 60) -``` - -## VirusTotal Integration - -```help - --vtkey string Virustotal API key for hash / sample uploads - --vtmode string VirusTotal lookup mode (limited = hash lookups only, full = hash and sample uploads) (default "limited") - --vtscore int Minimum score for hash lookup / sample upload to VirusTotal (default 40) - --vtaccepteula By specifying this option, you accept VirusTotal's EULA: https://www.virustotal.com/en/about/terms-of-service/ - --vtwaitforquota Wait if the VirusTotal API key quota is exceeded - --vtverbose Show more information from VirusTotal -``` - -## Debugging and Info - -```help - --debug Show Debugging Output - --trace Show Tracing Output - --printall Print all files that are checked (noisy) - --print-signatures Show THOR Signatures and IOCs and exit - --version Show THOR, signature and software versions and exit - -h, --help Show help for most important options and exit - --fullhelp Show help for all options and exit -``` +https://thor-manual.nextron-systems.com/en/latest/usage/flags.html diff --git a/thor-help/thor-usage.txt b/thor-help/thor-usage.txt deleted file mode 100644 index 22708a3..0000000 --- a/thor-help/thor-usage.txt +++ /dev/null @@ -1,301 +0,0 @@ -THOR APT Scanner - -Version 10.7.20 -(c) Nextron Systems GmbH - -> Scan Options - -t, --template string Process default scan parameters from this YAML file - --generate-config Print a YAML config from the given parameters and exit - -p, --path strings Scan a specific file path. Define multiple paths by specifying this option multiple times. Append ':NOWALK' to the path for non-recursive scanning (default: only the system drive) (default []) - --allhds (Windows Only) Scan all local hard drives (default: only the system drive) - --alldrives Scan all local drives, including network drives (default: only the system drive). Requires a Forensic Lab license. - --max_file_size uint Max. file size to check (larger files are ignored). Increasing this limit will also increase memory usage of THOR. (default 30MB) - --max_log_lines int Maximum amount of lines to check in a log file before skipping the remaining lines (default 1000000) - --max_process_size uint Max process size to check (larger processes won't be scanned) (default 2GB) - --max_runtime int Maximum runtime in hours. THOR will stop once this time has run out. 0 means no maximum runtime. (default 168) - --nodoublecheck Don't check whether another THOR instance is running (e.g. in Lab use cases when several mounted images are scanned simultaneously on a single system) (requires a Forensic Lab license) - -f, --epoch strings Specify a range of days with attacker activity as start and end date pairs. - Files created/modified between these days (including the specified start, excluding the specified end) will receive an extra score. - Example: -f 2009-10-09 -f 2009-10-10 marks the 09.10.2009 as relevant. (default []) - --epochscore int Score to add for files that were created/modified on days with attacker activity (see --epoch parameter) (default 35) - --insecure Skip TLS host verification (insecure) - --ca strings Root CA for host certificate verification during TLS handshakes (default []) - --cross-platform Apply IOCs with path separators platform independently. - --require-admin Terminate immediately if THOR is executed without administrator rights. - --follow-symlinks When encountering a symlink during the file scan that points to a directory, scan the directory. - --max-recursion-depth uint Maximum depth of archives to scan (default 4) - --max-nested-objects uint Maximum number of files per archive to scan (default 10000) - -> Scan Modes - --quick Activate a number of flags to speed up the scan at cost of some detection. - This is equivalent to: --noeventlog --nofirewall --noprofiles --nologscan --noevtx --nohotfixes --nomft --lookback 3 --lookback-modules filescan - --soft Skip CPU and RAM intensive modules (Mutexes, Firewall, Logons, Network sessions and shares, LSA sessions, open files, hosts file), don't decompress executables and doesn't perform a DoublePulsar backdoor check, lower max CPU usage to 70% and set low priority for THOR. - This mode activates automatically on systems with 1 CPU core or less than 1024 MB RAM. - --intense Paranoid scan mode that disables all safe guards. Only use this mode in lab scanning scenarios. We don't recommend using this mode to live scan productive systems. (enables: memory intensive extra modules) - --diff Set lookback time (see --lookback) for each module to the last time the module ran successfully and activates --global-lookback. - Effectively, this means that only elements that changed since the last scan are examined. (only works if ThorDB has been active) - --lookback int Specify how many past days shall be analyzed. Event log entries from before this point will be ignored. 0 means no limit (default 0). - --global-lookback Apply Lookback to all modules that support it (not only Eventlog). See also --lookback and --lookback-modules. - Warning: Timestomping or similar methods of antivirus evasion may result in elements not being examined. - --force-aptdir-lookback Enforce lookback application on all files in the FileScan module. By default, especially endangered directories ignore the lookback value. - --lookback-modules strings Apply Lookback to the given modules. See also --lookback and --modules. - Warning: Timestomping or similar methods of antivirus evasion may result in elements not being examined. (default []) - --lab Lab scan mode - scan only the file system, disable resource checks and quick mode, activate intense mode, disable ThorDB, apply IOCs platform independently and use all CPU cores. - This option scans all drives by default, but is often used with -p to scan only a single path. Requires a Forensic Lab license. - --virtual-map strings Rewrite found file paths to use a different prefix. - This can be useful for mounted images, where the current location of files does not match the original location and therefore references might be out of date. - Specify the original and current path as --virtual-map path/to/current/location:path/to/original/location. - On Windows, drive names are also supported, e.g. specify --virtual-map F:C if the drive on F: was originally used as C:. - Requires a Forensic Lab license. (default []) - -> Resource Options - -c, --cpulimit float Pause any THOR actions while the overall CPU usage exceeds this value (in percent). Minimum is 15% (default 95) - --nocpulimit Disable cpulimit check - --nosoft Disable automatic activation of soft mode (see --soft) - --norescontrol Do not check whether the system is running out of resources. Use this option to enforce scans that have been canceled due to resource scarcity. (use with care!) - --minmem uint Cancel the running scan if the amount of free physical memory drops below this value (in MB) (default 50) - --lowprio Reduce the priority of the THOR process to a lower level - --verylowprio Reduce the priority of the THOR process to a very low level - --lowioprio Reduce the disk priority of the THOR process to a lower level - --nolowprio Do not reduce the priority of the THOR process to a lower level due to soft mode (see --soft) - --nolockthread Do not lock calls to C libraries to main thread (this may increase performance at the cost of memory usage) - --yara-stack-size int Allocate this number of slots for the YARA stack. Increasing this limit will allow you to use larger rules, albeit with more memory overhead. (default 32768) - --yara-timeout int Cancel any YARA checks that take longer this amount of time (in seconds) (default 90) - --threads IntVar Run this amount of THOR threads in parallel. Numbers <= 0 are subtracted from the number of cores (0=use all cores), e.g. use -2 to use all cores except for two. (default 1) - --bulk-size uint Check this amount of elements together, e.g. log lines or registry entries (default 20MB) - -> Special Scan Modes - -m, --image_file string Scan only the given single memory image / dump file (don't use for disk images, scan them mounted with --lab). Requires a Forensic Lab license. - --image-chunk-size uint Scan image / dump files in chunks of this size (default 11MB) - -r, --restore_directory string Restore PE files with YARA rule matches during the DeepDive into the given folder - --restore_score int Restore only chunks with a total match score higher than the given value (default 50) - --dropzone Watch and scan all files dropped to a certain directory (which must be passed with -p). Disable resource checks and quick mode, activate intense mode, disable ThorDB and apply IOCs platform independently. Requires a Forensic Lab license. - --dropdelete Delete all files dropped to the drop zone after the scan. - --dropzone-delay uint32 Scan dropped files after specified delay in seconds (longer delay allow for longer copy processes (default 1) - -> Thor Thunderstorm Service - --thunderstorm Watch and scan all files sent to a specific port (see --server-port). Disable resource checks and quick mode, activate intense mode, disable ThorDB and apply IOCs platform independently. - --server-upload-dir string Path to a directory where THOR drops uploaded files. - If this path does not exist, THOR tries to create it. (default "/var/folders/cy/jvfmzjdx4jqcz6n4tj7gk0540000gn/T/thor-uploads") - --server-host string IP address that THOR's server should bind to. (default "127.0.0.1") - --server-port uint16 TCP port that THOR's server should bind to. (default 8080) - --server-cert string TLS certificate that THOR's server should use. If left empty, TLS is not used. - --server-key string Private key for the TLS certificate that THOR's server should use. Required if --server-cert is specified. - --server-store-samples string Sets whether samples should be stored permanently in the folder specified with --server-upload-dir. - Specify "all" to store all samples, or "malicious" to store only samples that generated a warning or an alert. (default "none") - --server-result-cache-size uint32 Size of the cache that is used to store results of asynchronous requests temporarily. - If set to 0, the cache is disabled and asynchronous results are not stored. (default 250000) - --pure-yara Only scan files using YARA signatures (disables all programmatic checks, STIX, Sigma, IOCs, as well as most features and modules) - --sync-only-threads uint16 Reserve this amount of THOR threads for synchronous requests - --force-max-file-size Enforce the maximum file size even on files like registry hives or log files which are usually scanned despite size. - -> License Retrieval - --asgard string Hostname of the ASGARD server from which a license should be requested, e.g. asgard.my-company.internal - --asgard-token string Use this token to authenticate with the License API of the asgard server. The token can be found in the 'Downloads' or 'Licensing' section in the ASGARD. This requires ASGARD 2.5+. - -q, --license-path string Path containing the THOR license (default is application directory) (default ".") - --portal-key string Get a license for this host from portal.nextron-systems.com using this API Key. - This feature is only supported for host-based server / workstation contracts. - --portal-contracts ints Use these contracts for license generation. If no contract is specified, the portal selects a contract by itself. See --portal-key. (default []) - --portal-nonewlic Only use an existing license from the portal. If none exists, exit. See --portal-key. - -> Active Modules -Available modules: Artifact-Collector, Autoruns, DeepDive, Dropzone, EnvCheck, Filescan, Hosts, KnowledgeDB, LoggedIn, ProcessCheck, Thunderstorm, Timestomp, UserDir, Users - -a, --module strings Activate the following modules only (Specify multiple modules with -a Module1 -a Module2 ... -a ModuleN). (default []) - --noprocs Do not analyze Processes - --nofilesystem Do not scan the file system - --noreg Do not analyze the registry - --nousers Do not analyze user accounts - --nologons Do not show currently logged in users - --noautoruns Do not analyse autorun elements - --noeventlog Do not analyse the eventlog - --norootkits Do not check for rootkits - --noevents Do not check for malicious events - --nodnscache Do not analyze the local DNS cache - --noenv Do not analyze environment variables - --nohosts Do not analyze the hosts file - --nomutex Do not check for malicious mutexes - --notasks Do not analyse scheduled tasks - --noservices Do not analyze services - --noprofiles Do not analyze profile directories - --noatjobs Do not analyze jobs scheduled with the 'at' tool - --nonetworksessions Do not analyze network sessions - --nonetworkshares Do not analyze network shares - --noshimcache Do not analyze SHIM Cache entries - --nohotfixes Do not analyze Hotfixes - --nowmistartup Do not analyze startup elements using WMI - --nofirewall Do not analyze the local Firewall - --nowmi Disable all checks with WMI functions - --nolsasessions Do not analyze lsa sessions - --nomft Do not analyze the drive's MFT (default, unless in intense mode) - --mft Analyze the drive's MFT - --nopipes Do not analyze named pipes - --noetwwatcher Do not analyze ETW logs during THOR runtime - --nointegritycheck Do not check with the package manager for package integrity on Linux - --notimestomp Disable timestomping detection - --nocron Disable crontab parsing - --collector Activate Collector module: collects and zips various different files interesting for IR & DF - --collector-only Activate Collector module only: collects and zips various different files intresting for IR & DF - -> Module Extras - --process ints Process IDs to be scanned. Define multiple processes by specifying this option multiple times (default: all processes) (Module: ProcessCheck) (default []) - --dump-procs Generate process dumps for suspicious or malicious processes (Module: ProcessCheck) - --max-procdumps uint Create at most this many process dumps (Module: ProcessCheck) (default 10) - --procdump-dir string Store process dumps of suspicious processes in this directory (Module: ProcessCheck) (default "/var/lib/thor") - -n, --eventlog-target strings Scan specific Eventlogs (e.g. 'Security' or 'Microsoft-Windows-Sysmon/Operational') (Module: Eventlog) (default []) - --nodoublepulsar Do not check for DoublePulsar Backdoor (Module: Rootkit) - --full-registry Do not skip registry hives keys with less relevance (Module: Registry) - --noregwalk Do not scan the whole registry during the registry scan - --showdeleted Show deleted files found in the MFT as 'info' messages. - --allfiles Scan all files, even ones that are usually not interesting. Sets --max_file_size to 200MB unless specified otherwise. - --ads Scan Alternate Data Streams for all files - --collector-output string Output path for the ZIP archive created by the 'Artifact-Collector' module (default ":hostname:_collector.zip") - --collector-print-config Output default 'Artifact-Collector' config and exit - --collector-dry-run Run 'Artifact-Collector' in dry-run mode - files will be listed in the output but not added to the output archive - --collector-no-mft Disable MFT parsing in the 'Artifact-Collector' (faster, but might cause some files to be not accessible) - --collector-config string Config file for 'Artifact-Collector' module - --collector-max-filesize uint Max size for files the 'Artifact-Collector' module should collect - 0 means no limit (default 0B) - -> Active Features - --nothordb Do not use or create ThorDB database for holding scan information - --nosigma Disable Sigma signatures - --dumpscan Scan memory dumps - --nologscan Do not scan log files (identified by .log extension or location) - --noyara Disable checks with YARA - --nostix Disable checks with STIX - --noarchive Do not scan contents of archives - --noc2 Disable checks for known C2 Domains - --noprochandles Do not analyze process handles - --noprocconnections Do not analyze process connections - --noamcache Do not analyze Amcache files - --noregistryhive Do not analyze Registry Hive files - --noexedecompress Do not decompress and scan portable executables - --nowebdirscan Do not analyze web directories that were found in process handles - --novulnerabilitycheck Do not analyze system for vulnerabilities - --noprefetch Do not analyze prefetch directory - --nogroupsxml Do not analyze groups.xml - --nowmipersistence Do not check WMI Persistence - --nolnk Do not analyze LNK files - --noknowledgedb Do not check Knowledge DB on Mac OS - --nower Do not analyze .wer files - --noevtx Do not analyze EVTX files - --noauthorizedkeys Do not analyze authorized_keys files - --noimphash Do not calculate imphash for suspicious EXE files (Windows only) - --c2-in-memory Apply C2 IOCs on process memory (not recommended unless you are willing to accept many false positives on browser and other process memories) - --custom-c2-in-memory Apply custom C2 IOCs on process memory - --noeml Disable Email parser - --noetl Disable ETL parser - --noauditlog Disable Audit log parser - --nomftfile Disable MFT file parser - --nounescape Disable unescape feature - --nommap Disable reading data from scanned files via memory mapping (except for YARA scans) - -> Feature Extras - --customonly Use custom signatures only (disables all internal THOR signatures and detections) - --init-selector strings Load only signatures where metadata (rule name, title, tags, description or similar) contains the given string. Use --print-signatures to list metadata of all signatures. (default []) - --init-filter strings Do not load signatures where metadata (rule name, title, tags, description or similar) contains the given string. Use --print-signatures to list metadata of all signatures. (default []) - --full-proc-integrity Increase sensitivity of --processintegrity for process impersonation detection. Likely to cause false positives, but also better at detecting real threats. - --processintegrity Run PE-Sieve to check for process integrity (Windows only) - --split-registry-keys Scan registry values separately instead of scanning the whole key at once. This is useful for large registry keys with many values. - -> Output Options - -l, --logfile string Log file for text output (default ":hostname:_thor_:time:.txt") - --htmlfile string Log file for HTML output (default ":hostname:_thor_:time:.html") - --nolog Do not generate text or HTML log files - --nohtml Do not create an HTML report file - --appendlog Append text log to existing log instead of overwriting - --keyval Format text and HTML log files with key value pairs to simplify the field extraction in SIEM systems (key='value') - --jsonfile string[=":hostname:_thor_:time:.json"] Log file for JSON output. If no value is specified, defaults to :hostname:_thor_:time:.json. - --jsonv2 Print JSON logs in the v2 format, which is easier to parse than the old v1 format - -o, --csvfile string Generate a CSV containing MD5,Filepath,Score for all files with at least the minimum score (default ":hostname:_files_md5s.csv") - --nocsv Do not write a CSV of all mentioned files with MD5 hash (see --csvfile) - --stats-file string[=":hostname:_stats.csv"] Generate a CSV file containing the scan summary in a single line. If no value is specified, defaults to :hostname:_stats.csv. - -e, --rebase-dir string Specify the output directory where all output files will be written. Defaults to the current working directory. - --suppresspi Suppress all personal information in log outputs to comply with local data protection policies - --eventlog Log to windows application eventlog - -x, --min int Only report files with at least this score (default 40) - --max-reasons int Show at most X reasons why a match is considered dangerous (0 = no limit) (default 2) - --printshim Include all SHIM cache entries in the output as 'info' level messages - --printamcache Include all AmCache entries in the output as 'info' level messages - -j, --overwrite-hostname string Override the local hostname value with a static value (useful when scanning mounted images in the lab. Requires a Forensic Lab license. (default "ion.local") - -i, --scanid string Specify a scan identifier (useful to filter on the scan ID, should be unique) - --scanid-prefix string Specify a prefix for the scan ID that is concatenated with a random ID if neither --scanid nor --noscanid are specified (default "S-") - --noscanid Do not automatically generate a scan identifier if none is specified - --silent Do not print anything to command line - --cmdjson Format command line output as JSON - --cmdkeyval Use key-value pairs for command line output, see --keyval - --encrypt Encrypt the generated log files and the MD5 csv file - --pubkey string Use this RSA public key to encrypt the logfile and csvfile (see --encrypt). Both --pubkey="" and --pubkey="" are supported. - --nocolor Do not use ANSI escape sequences for colorized command line output - --genid Print a unique ID for each log message. Identical log messages will have the same ID. - --truncate int Max. length per THOR value (0 = no truncation) (default 2048) - --registry_depth_print int Don't print info messages when traversing registry keys at a higher depth than this (default 1) - --utc Print timestamps in UTC instead of local time zone - --rfc3339 Print timestamps in RFC3339 (YYYY-MM-DD'T'HH:mm:ss'Z') format - --reduced Reduced output mode - only warnings, alerts and errors will be printed - --printlicenses Print all licenses to command line (default: only 10 licenses will be printed) - --local-syslog Print THOR events to local syslog - --showall Print rule matches even if that rule already matched more than 10 times. - --max-hits uint Report at most X matches of a rule or IOC during the complete THOR scan. 0 means all hits will be reported. (default 10000) - --ascii Don't print non-ASCII characters to command line and log files - --string-context uint When printing strings from YARA matches, include this many bytes surrounding the match (default 50) - --include-info-in-html Include info messages in the HTML report - --audit-trail string Output file for audit trail - --background string Optimize font colors for given terminal background (options: default, light, dark) (default "default") - -> ThorDB - --dbfile string Location of the thor.db file (default "/var/lib/thor/thor10.db") - --resumeonly Don't start a new scan, only finish an interrupted one. If no interrupted scan exists, nothing is done. - --resume Store information while running that allows to resume an interrupted scan later. If a previous scan was interrupted, resume it instead of starting a new one. - -> Syslog - -s, --syslog strings Write output to the specified syslog server, format: server[:port[:syslogtype[:sockettype]]]. - Supported syslog types: DEFAULT/CEF/JSON/SYSLOGJSON/SYSLOGKV - Supported socket types: UDP/TCP/TCPTLS - Examples: -s syslog1.dom.net, -s arcsight.dom.net:514:CEF:UDP, -s syslog2:4514:DEFAULT:TCP, -s syslog3:514:JSON:TCPTLS (default []) - --rfc3164 Truncate long Syslog messages to 1024 bytes - --rfc5424 Truncate long Syslog messages to 2048 bytes - --rfc Use strict syslog according to RFC 3164 (simple host name, shortened message) - --maxsysloglength int Truncate Syslog messages to the given length (0 means no truncation). This only applies to non-JSON formatted syslog. (default 2048) - --cef_level int Define the minimum severity level to log to CEF syslogs (Debug=1, Info=3, Notice=4, Error=5, Warning=8, Alarm=10) (default 4) - -> Reporting - --notice int Minimum score on which a notice is generated (default 40) - --warning int Minimum score on which a warning is generated (default 60) - --alert int Minimum score on which an alert is generated (default 81) - --nofserrors Silently ignore filesystem errors - --minimum-sigma-level string Only report sigma rule matches with this level or higher (default "high") - -> THOR Remote - --remote strings Target host (use multiple --remote statements for a set of hosts) (default []) - --remote-user string Username (if not specified, windows integrated authentication is used) - --remote-password string Password to be used to authenticate against remote hosts - --remote-prompt Prompt for password for remote hosts - --remote-debug Debug Mode for THOR Remote - --remote-dir string Upload THOR to this remote directory - --remote-workers int Number of concurrent scans (default 25) - --remote-rate int Number of seconds to wait between scan starts (default 30) - -> Automatic Collection of Suspicious Files (Bifrost) - --bifrost2Server string Server running the Bifrost 2 quarantine service. THOR will upload all suspicious files to this server. - This flag is only usable when invoking THOR from ASGARD 2. - --bifrost2Score int Send all files with at least this score to the Bifrost 2 quarantine service. - This flag is only usable when invoking THOR from ASGARD 2. (default 60) - -> VirusTotal Integration - --vtkey string Virustotal API key for hash / sample uploads - --vtmode string VirusTotal lookup mode (limited = hash lookups only, full = hash and sample uploads) (default "limited") - --vtscore int Minimum score for hash lookup / sample upload to VirusTotal (default 40) - --vtaccepteula By specifying this option, you accept VirusTotal's EULA: https://www.virustotal.com/en/about/terms-of-service/ - --vtwaitforquota Wait if the VirusTotal API key quota is exceeded - --vtverbose Show more information from VirusTotal - -> Debugging and Info - --debug Show Debugging Output - --trace Show Tracing Output - --printall Print all files that are checked (noisy) - --print-signatures Show THOR Signatures and IOCs and exit - --print-signatures-json Show THOR Signatures and IOCs as JSON and exit - --version Show THOR, signature and software versions and exit - -h, --help Show help for most important options and exit - --fullhelp Show help for all options and exit - --completions string Generate shell completions for the specified shell (bash, zsh, fish, powershell) diff --git a/thor-seed/README.md b/thor-seed/README.md index 03b4b79..d3e6ca1 100644 --- a/thor-seed/README.md +++ b/thor-seed/README.md @@ -21,18 +21,18 @@ The script itself writes an extensive log named `thor-seed.log`. You can deactiv - PowerShell version 3 - PowerShell FullLanguage mode - 70 MB of temporary disk space -- Network connection to a THOR source (ASGARD, Nextron cloud servers, THOR/THOR Lite as ZIP on a web server) +- Network connection to a THOR source (Management Center, Nextron cloud servers, THOR/THOR Lite as ZIP on a web server) ## THOR Sources THOR Seed retrieves the THOR program package from different locations: -### From an on-premise ASGARD server +### From an on-premise Management Center server -For details on ASGARD see [ASGARD's product page](https://www.nextron-systems.com/asgard-management-center/). +For details see the [Management Center's product page](https://www.nextron-systems.com/management-center/). ```console -thor-seed.ps1 -AsgardServer asgard1.internal -Token 74y47Wjw3wWRKlmBu4EUWFzGY-QWgdmzRZ +thor-seed.ps1 -ManagementCenter mgmt-center.internal -Token 74y47Wjw3wWRKlmBu4EUWFzGY-QWgdmzRZ ``` ### From Nextron cloud servers @@ -51,23 +51,23 @@ thor-seed.ps1 -CustomUrl https://web1.internal/thor/mythor-pack.zip If more than one THOR source is configured, THOR Seed uses the following precedence and prints a warning that explains which source is selected: -1. `-AsgardServer` +1. `-ManagementCenter` 2. `-UseCloud` 3. `-CustomUrl` ## Parameters -### -AsgardServer +### -ManagementCenter -Enter the server name (FQDN) or IP address of your ASGARD instance. +Enter the server name (FQDN) or IP address of your Management Center instance. ### -UseCloud -Use the official Nextron cloud servers instead of an ASGARD instance. +Use the official Nextron cloud servers instead of an Management Center instance. ### -Token -Download token used when connecting to Nextron's customer portal or an ASGARD instance. +Download token used when connecting to Nextron's customer portal or an Management Center instance. ### -Comment @@ -315,7 +315,7 @@ When THOR Seed is started without a THOR source, it tries to show its PowerShell Get-Help : Get-Help could not find .\thor-seed.ps1 in a help file in this session. ``` -This warning does not indicate a THOR scan failure. Start THOR Seed with one of the required source parameters, for example `-AsgardServer`, `-UseCloud` or `-CustomUrl`. To view the usage information, use this README or run: +This warning does not indicate a THOR scan failure. Start THOR Seed with one of the required source parameters, for example `-ManagementCenter`, `-UseCloud` or `-CustomUrl`. To view the usage information, use this README or run: ```powershell Get-Help .\thor-seed.ps1 -Detailed @@ -330,7 +330,7 @@ powershell.exe -ExecutionPolicy Bypass .\thor-seed.ps1 -CustomUrl https://my-web ``` ```console -powershell.exe -ExecutionPolicy Bypass .\thor-seed.ps1 -AsgardServer asgard1.internal -Token 74y47Wjw3wWRKlmBu4EUWFzGY-QWgdmzRZ -IgnoreSSLErrors +powershell.exe -ExecutionPolicy Bypass .\thor-seed.ps1 -ManagementCenter mgmt-center.internal -Token 74y47Wjw3wWRKlmBu4EUWFzGY-QWgdmzRZ -IgnoreSSLErrors ``` ### Exit Codes diff --git a/thor-seed/thor-seed.ps1 b/thor-seed/thor-seed.ps1 index d333e38..ac1ec6e 100644 --- a/thor-seed/thor-seed.ps1 +++ b/thor-seed/thor-seed.ps1 @@ -13,13 +13,13 @@ .SYNOPSIS The "thor-seed" script downloads THOR and executes it .DESCRIPTION - The "thor-seed" script downloads THOR from an ASGARD instance, the Nextron cloud or a custom URL and executes THOR on the local system writing log files or transmitting syslog messages to a remote system - .PARAMETER AsgardServer - Enter the server name (FQDN) or IP address of your ASGARD instance. + The "thor-seed" script downloads THOR from an Management Center instance, the Nextron cloud or a custom URL and executes THOR on the local system writing log files or transmitting syslog messages to a remote system + .PARAMETER ManagementCenter + Enter the server name (FQDN) or IP address of your Management Center instance. .PARAMETER UseCloud - Use the official Nextron cloud systems instead of an ASGARD instance. + Use the official Nextron cloud systems instead of an Management Center instance. .PARAMETER Token - Download token used when connecting to Nextron's cloud service instead of an ASGARD instance. + Download token used when connecting to Nextron's cloud service instead of an Management Center instance. .PARAMETER Comment A comment that will be transmitted to the Nextron cloud servers and shown in the customer portal for the generated license (only used with -UseCloud). .PARAMETER CustomUrl @@ -49,19 +49,19 @@ .PARAMETER ProxyCredentials Proxy credentials to authenticate. Bye default Empty. .EXAMPLE - ASGARD examples + Management Center examples - # ASGARD without token (if token enforcement is disabled) - thor-seed -AsgardServer asgard1.intranet.local + # Management Center without token (if token enforcement is disabled) + thor-seed -ManagementCenter mgmt-center1.intranet.local - # ASGARD with token (if token enforcement is enabled) - thor-seed -AsgardServer asgard1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY + # Management Center with token (if token enforcement is enabled) + thor-seed -ManagementCenter mgmt-center1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY - # ASGARD with token and self-signed TLS cert in lab environments - thor-seed -AsgardServer asgard1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -IgnoreSSLErrors + # Management Center with token and self-signed TLS cert in lab environments + thor-seed -ManagementCenter mgmt-center1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -IgnoreSSLErrors - # ASGARD with Analysis Cockpit upload - thor-seed -AsgardServer asgard1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -Cockpit cockpit1.intranet.local -CockpitKey YOUR_API_KEY + # Management Center with Analysis Cockpit upload + thor-seed -ManagementCenter mgmt-center1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -Cockpit cockpit1.intranet.local -CockpitKey YOUR_API_KEY .EXAMPLE Nextron cloud examples @@ -77,18 +77,18 @@ thor-seed -CustomUrl https://web1.server.local/thor/mythor-pack.zip # Start a scan with custom output path and random delay window - thor-seed -AsgardServer asgard1.intranet.local -OutputPath C:\Windows\Temp\thor -RandomDelay 300 + thor-seed -ManagementCenter mgmt-center1.intranet.local -OutputPath C:\Windows\Temp\thor -RandomDelay 300 # Limit THOR CPU usage to reduce user impact and fan noise - thor-seed -AsgardServer asgard1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -CpuLimit 40 + thor-seed -ManagementCenter mgmt-center1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -CpuLimit 40 # Disable THOR resource safeguards (advanced use only) - thor-seed -AsgardServer asgard1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -NoResControl + thor-seed -ManagementCenter mgmt-center1.intranet.local -Token 6Nf0Qv8F4jA2sZ9pHk1wY -NoResControl # Remove THOR output files from previous runs thor-seed -Cleanup .NOTES - You can set a static download token and ASGARD server in this file (see below in the parameters) + You can set a static download token and Management Center server in this file (see below in the parameters) We recommend using the configuration sections in this script to adjust the scan settings. It includes presets for scan configs and false positive filters. @@ -104,17 +104,17 @@ param ( [Parameter( - HelpMessage = 'The ASGARD instance to download THOR from (license will be generated on that instance)')] + HelpMessage = 'The Management Center instance to download THOR from (license will be generated on that instance)')] [ValidateNotNullOrEmpty()] - [Alias('AMC')] - [string]$AsgardServer, + [Alias('MC')] + [string]$ManagementCenter, [Parameter(HelpMessage = "Use Nextron's cloud to download THOR and generate a license")] [ValidateNotNullOrEmpty()] [Alias('CP')] [switch]$UseCloud, - [Parameter(HelpMessage = "Set a download token (used with ASGARD and Nextron cloud servers)")] + [Parameter(HelpMessage = "Set a download token (used with Management Center and Nextron cloud servers)")] [ValidateNotNullOrEmpty()] [Alias('T')] [string]$Token, @@ -203,14 +203,14 @@ param # Write local log file for THOR Seed script activity #[bool]$NoLog = $True -# ASGARD Server (IP or FQDN) -#[string]$AsgardServer = "asgard.beta.nextron-systems.com" +# Management Center Server (IP or FQDN) +#[string]$ManagementCenter = "mgmt-center.beta.nextron-systems.com" # Use Nextron cloud servers #[bool]$UseCloud = $True # Download Token -# usable with Nextron cloud servers and ASGARD +# usable with Nextron cloud servers and Management Center #[string]$Token = "YOUR DOWNLOAD TOKEN" # Comment @@ -225,7 +225,7 @@ param #[string]$CockpitKey = "YOUR ANALYSIS COCKPIT API TOKEN" # Ignore SSL Errors -# Helpful when using a local ASGARD instance +# Helpful when using a local Management Center instance #$IgnoreSSLErrors = $True # Disable THOR resource safeguards (advanced use only) @@ -362,11 +362,11 @@ $script:CockpitUploadSucceeded = $False $script:SummaryGuidance = @() # Show Help ----------------------------------------------------------- -# No ASGARD server -if ($Args.Count -eq 0 -and $AsgardServer -eq "" -and $UseCloud -eq $False -and $CustomUrl -eq "") +# No Management Center server +if ($Args.Count -eq 0 -and $ManagementCenter -eq "" -and $UseCloud -eq $False -and $CustomUrl -eq "") { Get-Help $MyInvocation.MyCommand.Definition -Detailed - Write-Host -ForegroundColor Yellow 'Note: You must at least define an ASGARD server (-AsgardServer), use the Nextron cloud (-UseCloud) with an download token (-Token) or provide a custom URL to a THOR / THOR Lite ZIP package on a webserver (-CustomUrl)' + Write-Host -ForegroundColor Yellow 'Note: You must at least define an Management Center server (-ManagementCenter), use the Nextron cloud (-UseCloud) with an download token (-Token) or provide a custom URL to a THOR / THOR Lite ZIP package on a webserver (-CustomUrl)' return } # Nextron cloud servers but no download token @@ -710,9 +710,9 @@ if ($AutoDetectPlatform -ne "") # Report source precedence explicitly when more than one THOR source is configured. $RequestedThorSources = @() -if (-not [string]::IsNullOrEmpty($AsgardServer)) +if (-not [string]::IsNullOrEmpty($ManagementCenter)) { - $RequestedThorSources += "ASGARD (-AsgardServer $AsgardServer)" + $RequestedThorSources += "Management Center (-ManagementCenter $ManagementCenter)" } if ($UseCloud) { @@ -725,15 +725,15 @@ if (-not [string]::IsNullOrEmpty($CustomUrl)) if ($RequestedThorSources.Count -gt 1) { $SelectedThorSource = "custom URL (-CustomUrl)" - if (-not [string]::IsNullOrEmpty($AsgardServer)) + if (-not [string]::IsNullOrEmpty($ManagementCenter)) { - $SelectedThorSource = "ASGARD (-AsgardServer $AsgardServer)" + $SelectedThorSource = "Management Center (-ManagementCenter $ManagementCenter)" } elseif ($UseCloud) { $SelectedThorSource = "Nextron cloud (-UseCloud)" } - Write-Log "Multiple THOR sources specified: $($RequestedThorSources -join ', '). Using $SelectedThorSource based on precedence: -AsgardServer, then -UseCloud, then -CustomUrl." -Level "Warning" + Write-Log "Multiple THOR sources specified: $($RequestedThorSources -join ', '). Using $SelectedThorSource based on precedence: -ManagementCenter, then -UseCloud, then -CustomUrl." -Level "Warning" } # --------------------------------------------------------------------- @@ -858,9 +858,9 @@ if (-not (Test-OutputPathWritable -Path $OutputPath)) { Set-ExecutionFailure -Reason "Output path is not writable: $OutputPath" -Code 3 } -if ($AsgardServer -and [string]::IsNullOrWhiteSpace($Token)) +if ($ManagementCenter -and [string]::IsNullOrWhiteSpace($Token)) { - Write-Log "No download token provided. This can work if your ASGARD does not require download tokens." -Level "Note" + Write-Log "No download token provided. This can work if your Management Center does not require download tokens." -Level "Note" Write-Log "If the download fails with HTTP 401/403, rerun with -Token ." -Level "Note" } @@ -918,14 +918,14 @@ if (-not $script:ExecutionFailed) $WebClient.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials } # Download Source - # Asgard Instance - if ($AsgardServer -ne "") + # Management Center Instance + if ($ManagementCenter -ne "") { - Write-Log "Attempting to download THOR from $AsgardServer" -Level "Progress" - # Generate download URL - pre ASGARD 2.11 - #$DownloadUrl = "https://$($AsgardServer):8443/api/v0/downloads/thor/thor10-win?hostname=$($Hostname)&type=$($LicenseType)&iocs=%5B%22default%22%5D&token=" - # Generate download URL - post ASGARD 2.11 - $DownloadUrl = "https://$($AsgardServer):8443/api/v1/downloads/thor?os=windows&type=$($LicenseType)&scanner=thor10%40latest&signatures=signatures&hostname=$($Hostname)&token=$($Token)" + Write-Log "Attempting to download THOR from $ManagementCenter" -Level "Progress" + # Generate download URL - pre Management Center 2.11 + #$DownloadUrl = "https://$($ManagementCenter):8443/api/v0/downloads/thor/thor10-win?hostname=$($Hostname)&type=$($LicenseType)&iocs=%5B%22default%22%5D&token=" + # Generate download URL - post Management Center 2.11 + $DownloadUrl = "https://$($ManagementCenter):8443/api/v1/downloads/thor?os=windows&type=$($LicenseType)&scanner=thor10%40latest&signatures=signatures&hostname=$($Hostname)&token=$($Token)" } # Netxron Customer Portal elseif ($UseCloud) @@ -957,7 +957,7 @@ if (-not $script:ExecutionFailed) } else { - Write-Log 'Download URL cannot be generated (select one of the three options: $AsgardServer, $UseCloud or $CustomUrl)' -Level "Error" + Write-Log 'Download URL cannot be generated (select one of the three options: $ManagementCenter, $UseCloud or $CustomUrl)' -Level "Error" Set-ExecutionFailure -Reason "Download URL cannot be generated." -Code 4 throw "Download URL cannot be generated." } @@ -1037,9 +1037,9 @@ if (-not $script:ExecutionFailed) { Write-Log "Note: you can find your download token here: https://portal.nextron-systems.com/" } - elseif ($AsgardServer) + elseif ($ManagementCenter) { - Write-Log "Note: ASGARD token settings and user token can be checked at: https://$($AsgardServer):8443/ui/user-settings#tab-Token" + Write-Log "Note: Management Center token settings and user token can be checked at: https://$($ManagementCenter):8443/ui/user-settings#tab-Token" } } # 400