Fenrir Simple Bash IOC Scanner Logo

Fenrir Simple Bash IOC Scanner

0
Free
Visit Website

Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise (IOCs): Hashes MD5, SHA1 and SHA256 (using md5sum, sha1sum, sha -a 256) File Names string - checked for substring of the full path, e.g. "temp/p.exe" in "/var/temp/p.exe" Strings grep in files C2 Server checking for C2 server strings in 'lsof -i' and 'lsof -i -n' output Hot Time Frame using stat in different modes - define min and max epoch time stamp and get all files that have been created in between Basic characteristics: Bash Script No installation or agent needed Uses common tools to extract attributes (e.g. md5sum, grep, stat in different modes) Intended to run on any Linux / Unix / OS X with Bash Low footprint - Ansible playbook with RAM drive solution Smart exclusions (file size, extension, certain directories) speeds up the scan process Why Fenrir? FENRIR is the 3rd tool after THOR and LOKI. THOR is our full featured APT Scanner with many modules and export types for corporate customers. LOKI is a free and open IOC scanner that uses YARA as signature format. The problem with both predecessors is that both have certain limitations.

FEATURES

ALTERNATIVES

Linux packet crafting tool for testing IDS/IPS and creating attack signatures.

Pure Python implementation of Microsoft RDP protocol with various tools and support for different security layers.

Passive Network Audit Framework (PNAF) v0.1.2 provides passive network auditing capabilities and is now a project of COSMIC-Chapter of The Honeynet Project.

PCAPdroid is a privacy-friendly app for tracking, analyzing, and blocking network connections on your device.

A website scanner that provides a sandbox for the web, allowing users to scan URLs and websites for potential threats and vulnerabilities.

A module for loading Bro logs as tables in Osquery

A simple web crawler written in Go

Sniffglue is a network sniffer tool written in Rust with advanced filter sensitivity options and secure packet processing.

PINNED