{"id":4732,"date":"2019-08-29T19:56:25","date_gmt":"2019-08-29T17:56:25","guid":{"rendered":"http:\/\/nextron.bsk-consulting.de\/?p=4732"},"modified":"2022-03-25T14:15:00","modified_gmt":"2022-03-25T13:15:00","slug":"new-feature-in-thor-v10-1-remote-scanning","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/","title":{"rendered":"New Feature in THOR v10.1 &#8211; Remote Scanning"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;3.26.6&#8243;][et_pb_row _builder_version=&#8221;3.27.2&#8243;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>THOR v10.1 features a mode of operation that is especially helpful in incident response or compromise assessment scenarios &#8211; remote scanning.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>Imagine that you&#8217;re in a firefighting scenario &#8211; a breach has been confirmed and management wants to have quick results on the extent of the compromise.\u00a0<\/p>\n<p>The new remote scanning feature called &#8220;THOR Remote&#8221; allows you to perform triage scans on hundreds of remote systems from a single admin workstation. You can think of it as an integrated PsExec.\u00a0<\/p>\n<p>No scripting, no agents, no hustle.\u00a0<span style=\"font-size: 18px;\">\u00a0<\/span><\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/08\/THOR_Remote.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;1_2,1_2&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_column type=&#8221;1_2&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>Benefits<\/p>\n<ul>\n<li>No agent<\/li>\n<li>No scripting<\/li>\n<li>Painless scans of many remote systems<\/li>\n<\/ul>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;1_2&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>Requirements<\/p>\n<ul>\n<li>Available on Windows only<\/li>\n<li>Accessible remote ports (135\/tcp, 445\/tcp)<\/li>\n<li>Account with local admin rights<\/li>\n<\/ul>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;3.26.6&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;3.26.6&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>All you need is the new version 10.1 of THOR and a command line of an admin user with the required privileges and open Windows ports (135\/tcp, 445\/tcp) on the remote systems.<\/p>\n<p>THOR will then switch into a new mode of operation and present a command line interface showing scan information and a scrollable pane for each log file. (see screenshot)<\/p>\n<p>THOR writes the log files to a local folder on the admin workstation or sends them via SYSLOG to your SIEM system.\u00a0<span style=\"font-size: 18px;\">\u00a0<\/span><\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;3.26.6&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/10\/Screenshot-2019-10-29-at-18.01.02.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>You can also define a number of concurrent scans (workers) and delay the scan starts to distribute the load evenly among the target systems. This is beneficial when you scan numerous virtual machines running on a few host systems.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/08\/Screenshot-2019-08-27-at-12.48.48.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;3.27.2&#8243;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_video src=&#8221;https:\/\/www.youtube.com\/watch?v=qQgMItxdyqQ&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243; thumbnail_overlay_color=&#8221;rgba(0,0,0,0.6)&#8221;][\/et_pb_video][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;3.27.2&#8243;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;3.27.2&#8243;][et_pb_text _builder_version=&#8221;3.27.4&#8243;]<\/p>\n<p>A complete triage scan of your internal domain can&#8217;t be more comfortable.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>THOR v10.1 features a mode of operation that is especially helpful in incident response or compromise assessment scenarios &#8211; remote scanning.\u00a0 Imagine that you&#8217;re in a firefighting scenario &#8211; a breach has been confirmed and management wants to have quick results on the extent of the compromise.\u00a0 The new remote scanning feature called &#8220;THOR Remote&#8221; allows you to perform triage scans on hundreds of remote systems from a single admin workstation. You can think of it as an integrated PsExec.\u00a0 No scripting, no agents, no hustle.\u00a0\u00a0Benefits No agent No scripting Painless scans of many remote systems Requirements Available on Windows only Accessible remote ports (135\/tcp, 445\/tcp) Account with local admin rights All you need is the new version 10.1 of THOR and a command line of an admin user with the required privileges and open Windows ports (135\/tcp, 445\/tcp) on the remote systems. THOR will then switch into a new mode of operation and present a command line interface showing scan information and a scrollable pane for each log file. (see screenshot) THOR writes the log files to a local folder on the admin workstation or sends them via SYSLOG to your SIEM system.\u00a0\u00a0You can also define a number of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"audio","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[34,46,32],"tags":[69,66,82,206,172,7,78,137,205],"class_list":["post-4732","post","type-post","status-publish","format-audio","hentry","category-loki","category-newsletter","category-thor","tag-compromise-assessment","tag-incident-response","tag-ioc","tag-psexec","tag-remote","tag-scanner","tag-scanning","tag-tool","tag-triage","post_format-post-format-audio"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>New Feature in THOR v10.1 - Remote Scanning - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"New Feature in THOR v10.1 &#8211; Remote Scanning\",\"datePublished\":\"2019-08-29T17:56:25+00:00\",\"dateModified\":\"2022-03-25T13:15:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/\"},\"wordCount\":570,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"compromise assessment\",\"incident response\",\"ioc\",\"psexec\",\"remote\",\"scanner\",\"scanning\",\"tool\",\"triage\"],\"articleSection\":[\"LOKI\",\"Newsletter\",\"THOR\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/\",\"name\":\"New Feature in THOR v10.1 - Remote Scanning - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2019-08-29T17:56:25+00:00\",\"dateModified\":\"2022-03-25T13:15:00+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Feature in THOR v10.1 - Remote Scanning - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"New Feature in THOR v10.1 &#8211; Remote Scanning","datePublished":"2019-08-29T17:56:25+00:00","dateModified":"2022-03-25T13:15:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/"},"wordCount":570,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["compromise assessment","incident response","ioc","psexec","remote","scanner","scanning","tool","triage"],"articleSection":["LOKI","Newsletter","THOR"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/","url":"https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/","name":"New Feature in THOR v10.1 - Remote Scanning - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2019-08-29T17:56:25+00:00","dateModified":"2022-03-25T13:15:00+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2019\/08\/29\/new-feature-in-thor-v10-1-remote-scanning\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/4732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=4732"}],"version-history":[{"count":13,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/4732\/revisions"}],"predecessor-version":[{"id":7237,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/4732\/revisions\/7237"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=4732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=4732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=4732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}