Open-source DFIR-инструмент для анализа артефактов Linux
Ключевые возможности:
The software consists in several tabs, each of them dedicated to a given artifact category. The tabs of the GUI are as follows:
Log Parsers - parses the most common Linux logs and returns them in a CSV file easy to filter out with Excel
ELF File Analysis - Extracts strings, metadata and imported functions from an ELF executable. This also does some basic anomaly checks in the ELF sections
/Etc/Shadow - a simple /etc/shadow parser
/Etc/Passwd - a simple /etc/passwd parser
/Proc/Modules - reads the /proc/modules artifact and interprets its flags (if a module tainted the Kernel, if it is not part of the official Kernel etc.)
Proc Reconstruct - examines the /proc virtual filesystem and returns important info on memory in an easy to review GUI
Crawlers - traverses the entire artifact collection, parses several artifact types and returns the parse output in consolidated views
RPM Package Analysis - examines an RPM package and extracts scripts, metadata, hashes etc.
DEB Package Analysis - examines a DEB package and extracts scripts, metadata, hashes etc.
SQLite Extractors - extracts tables from some Linux artifacts in SQLite format
Tree View - The entire collection can be viewed in tree mode with a built-in "Notepad++ like" editor and possibility to dump data in binary format
💻 Repo
🔗 Туториал
🦔 THF
#dfir #forensics #lap
✈️ Whitehat Lab 💬Chat