Fenrir Simple Bash IOC Scanner
Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise (IOCs): Hashes MD5, SHA1 and SHA256 (using md5sum, sha1sum, sha -a 256) File Names string - checked for substring of the full path, e.g. "temp/p.exe" in "/var/temp/p.exe" Strings grep in files C2 Server checking for C2 server strings in 'lsof -i' and 'lsof -i -n' output Hot Time Frame using stat in different modes - define min and max epoch time stamp and get all files that have been created in between Basic characteristics: Bash Script No installation or agent needed Uses common tools to extract attributes (e.g. md5sum, grep, stat in different modes) Intended to run on any Linux / Unix / OS X with Bash Low footprint - Ansible playbook with RAM drive solution Smart exclusions (file size, extension, certain directories) speeds up the scan process Why Fenrir? FENRIR is the 3rd tool after THOR and LOKI. THOR is our full featured APT Scanner with many modules and export types for corporate customers. LOKI is a free and open IOC scanner that uses YARA as signature format. The problem with both predecessors is that both have certain limitations.
FEATURES
ALTERNATIVES
Pure Python implementation of Microsoft RDP protocol with various tools and support for different security layers.
A textmode sniffer for tracking tcp streams and capturing data in various modes.
A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
An information gathering tool for DNS, subdomains, ports, and directories enumeration.
Firewall, Blackhole, and Privatizing Proxy for macOS with comprehensive security features.
A python tool for discovering endpoints, parameters, and wordlists in a given target
Safing Portmaster is an open-source application firewall that monitors network connections, blocks trackers system-wide, and allows custom filtering rules at both global and per-application levels.
PINNED
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
PTJunior
An AI-powered penetration testing platform that autonomously discovers, exploits, and documents vulnerabilities while generating NIST-compliant reports.
CTIChef.com Detection Feeds
A tiered cyber threat intelligence service providing detection rules from public repositories with varying levels of analysis, processing, and guidance for security teams.
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.