People often ask me if they still need our host based scanner THOR now that they have bought a network appliance that already checks all content that goes into and leaves their network. I normally answer that it is not a question of one solution versus another, but a combination of solutions to achieve the […]
Tag Archives: detect
Inverse Yara Signature Matching (Part 1/2)
During our investigations we encountered situations in which attackers replaced valid system files with other system files to achieve persistence and establish a backdoor on the systems. The most frequently used method was the replacement of the „sethc.exe“ with the valid command line „cmd.exe“ to establish a backdoor right in logon screen by pressing shift […]
Howto detect Ebury SSH Backdoor
Die folgende Yara Signatur kann für die Erkennung der Ebury SSH Backdoor verwendet werden. rule Ebury_SSHD_Malware_Linux { meta: description = "Ebury Malware" author = "Florian Roth" hash = "4a332ea231df95ba813a5914660979a2" strings: $s0 = "keyctl_set_reqkey_keyring" fullword $s1 = "recursive_session_key_scan" fullword $s2 = "keyctl_session_to_parent" fullword $s3 = "keyctl_assume_authority" fullword $s4 = "keyctl_get_security_alloc" fullword $s5 = "keyctl_instantiate_iov" fullword $s6 […]
Request a THOR Trial
White Papers
 |
APT Scanner THOR White Paper (DE) (PDF 1 MB) |
|
APT Scanner THOR White Paper (EN) (PDF 1 MB) |
|
APT Scanner THOR Slides (EN) (PDF 1.3 MB) |
|
THOR Cheat Sheet (PDF 0.07 MB) |
|
Splunk Übersicht (PDF 0.4 MB) |
|
Flyer der Hackerabwehr Schulung (PDF 0,5 MB) |
