In the recent months I had several talks with friends and coworkers about IOC scanning and how to integrate IOCs from threat intel feeds into our scanners or other products that our customers already use. People often tell me that EDR or client management product X already does IOC scanning and that we don’t need […]
Tag Archives: scan
Synergetic Effects of Network and Host Based APT Detection
People often ask me if they still need our host based scanner THOR now that they have bought a network appliance that already checks all content that goes into and leaves their network. I normally answer that it is not a question of one solution versus another, but a combination of solutions to achieve the […]
How to Scan for System File Manipulations with Yara (Part 2/2)
As a follow up on my first article about inverse matching yara rules I would like to add a tutorial on how to scan for system file manipulations using Yara and Powershell. The idea of inverse matching is that we do not scan for something malicious that we already know but for anomalies within the […]
Systeme mit RDP Schwachstelle MS12-020 im Netzwerk aufspüren
In einem Artikel des Security Monitoring Blogs wird beschrieben, wie man mit Hilfe eines Nmap Skriptes die RDP Schwachstelle MS12-020 an Systemen mittels eines Netzwerkscans aufspüren kann. Wir haben für einen unserer Kunden einen Paket des Nmap Scanners erzeugt, welches bereits das nötige Skript enthält und nur entpackt werden muss, um benutzt werden zu können. […]
Request a THOR Trial
White Papers
 |
APT Scanner THOR White Paper (DE) (PDF 1 MB) |
|
APT Scanner THOR White Paper (EN) (PDF 1 MB) |
|
APT Scanner THOR Slides (EN) (PDF 1.3 MB) |
|
THOR Cheat Sheet (PDF 0.07 MB) |
|
Splunk Übersicht (PDF 0.4 MB) |
|
Flyer der Hackerabwehr Schulung (PDF 0,5 MB) |
