{"id":5020,"date":"2019-12-04T12:56:26","date_gmt":"2019-12-04T11:56:26","guid":{"rendered":"http:\/\/nextron.bsk-consulting.de\/?p=5020"},"modified":"2022-03-25T14:14:59","modified_gmt":"2022-03-25T13:14:59","slug":"changes-in-upcoming-thor-version-10-3","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/","title":{"rendered":"Changes in Upcoming THOR Version 10.3"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_text _builder_version=&#8221;4.0.6&#8243;]<\/p>\n<h3>Refactored Handle Detection<\/h3>\n<p>We have completely refactored THOR&#8217;s malicious Handle detection.<\/p>\n<p>We now allow the use of regular expressions and combined all types in a single signature file named &#8220;malicious-handles.dat&#8221;.\u00a0<\/p>\n<p>Users can provide custom indicators by placing a file with the keyword &#8216;handles&#8217; in name into the folder .\/custom-signatures\/iocs<\/p>\n<p>&nbsp;<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-11.10.30.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_text _builder_version=&#8221;4.0.6&#8243;]<\/p>\n<h3>Process Handle Match Enrichment<\/h3>\n<p>Mutex, Named Pipe or Event matches will now trigger message enrichment in which the alert message is &#8220;enriched&#8221; with plenty of helpful information on the underlying process, including image file path, parent process and image file hashes.\u00a0<\/p>\n<p>This helps analysts to evaluate and classify the event.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-12.44.20.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_text _builder_version=&#8221;4.0.6&#8243;]<\/p>\n<h3>More Eventlog Sources<\/h3>\n<p>We&#8217;ve integrated more Windows logs in the default Eventlog scanning to detect keyword and filename IOCs in even more data sources.\u00a0<\/p>\n<p>This could increase scan duration significantly in cases in which you have defined custom unusually large maximum log sizes.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-12.36.58.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_text _builder_version=&#8221;4.0.6&#8243;]<\/p>\n<h3>Custom Eventlog and Registry Exclusions<\/h3>\n<p>Users can now exclude certain Registry paths or Eventlogs from scanning.\u00a0<\/p>\n<p>We&#8217;ve added two new and empty exclude files in the .\/config sub folder for your convenience.\u00a0\u00a0<\/p>\n<p>&nbsp;<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.0.6&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-12.53.14.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_text _builder_version=&#8221;4.0.4&#8243;]<\/p>\n<h3>Support for new Sigma Modifiers<\/h3>\n<p>THOR now supports the newest value modifiers used in the most recent version of the Sigma standard.<\/p>\n<ul>\n<li>endswith<\/li>\n<li>startswith<\/li>\n<\/ul>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/11\/Screenshot-2019-11-22-at-17.14.16.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_text _builder_version=&#8221;4.0.2&#8243;]<\/p>\n<h3>Case ID (CID) get renamed<\/h3>\n<p>Previous versions of THOR offered a parameter -i \/ &#8211;case-id to set a unique identifier that appears as &#8220;CID: identifier&#8221; in all log lines of this specific scan.\u00a0<\/p>\n<p>With version 10.3 this CID gets renamed to SCANID and will be generated by default.<\/p>\n<p>Every log line will contain a SCANID that makes it easier to associate a single\u00a0 line with the complete scan in reporting platforms like SIEM systems or ASGARD Analysis Cockpit.<\/p>\n<p>You can still overwrite that value manually for legacy reasons or in order to group multiple scan runs into a single logical report.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/11\/Screenshot-2019-11-22-at-17.22.46.png&#8221; _builder_version=&#8221;4.4.2&#8243; hover_enabled=&#8221;0&#8243;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.0.2&#8243;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.0.2&#8243;][et_pb_text _builder_version=&#8221;4.0.2&#8243;]<\/p>\n<p>Other Changes<\/p>\n<ul>\n<li>Feature: Log to local syslog with `&#8211;local-syslog` (Linux and macOS only)<\/li>\n<li><span style=\"font-size: 18px;\">Improvement: Filename IOC &#8220;slash to backslash&#8221; transformation now works platform independent\u00a0<\/span><\/li>\n<li>Improvement: SHIMCache Analysis in Registry Hives (not just live Registry)<\/li>\n<li>Improvement: Support for new license type &#8220;silent&#8221; (allows silent scans used in deployment tests)<\/li>\n<li>Improvement: YARA rule date in output messages<\/li>\n<li>Change: -j hostname will also adjust hostname in output file names<\/li>\n<li>Change: Don&#8217;t skip certain Registry paths with `&#8211;fullregistry` or in `&#8211;intense` mode<\/li>\n<li>Change: New value &#8220;max_file_size_intense&#8221; to be able to set a dedicated value for &#8220;intense&#8221; or &#8220;lab&#8221; scans<\/li>\n<li>Bugfix: missing start and end date in HTML report<\/li>\n<li>Bugfix: Message enrichment module processed duplicate values (e.g. Eventlog contained the filepath C:\\w1.exe three times, the message enrichment included the additional attributes like EXISTS, MD5, SHA1, FIRSTBYTES three times, which is unnecessary)\u00a0<\/li>\n<\/ul>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Refactored Handle Detection We have completely refactored THOR&#8217;s malicious Handle detection. We now allow the use of regular expressions and combined all types in a single signature file named &#8220;malicious-handles.dat&#8221;.\u00a0 Users can provide custom indicators by placing a file with the keyword &#8216;handles&#8217; in name into the folder .\/custom-signatures\/iocs &nbsp;Process Handle Match Enrichment Mutex, Named Pipe or Event matches will now trigger message enrichment in which the alert message is &#8220;enriched&#8221; with plenty of helpful information on the underlying process, including image file path, parent process and image file hashes.\u00a0 This helps analysts to evaluate and classify the event.\u00a0More Eventlog Sources We&#8217;ve integrated more Windows logs in the default Eventlog scanning to detect keyword and filename IOCs in even more data sources.\u00a0 This could increase scan duration significantly in cases in which you have defined custom unusually large maximum log sizes.\u00a0Custom Eventlog and Registry Exclusions Users can now exclude certain Registry paths or Eventlogs from scanning.\u00a0 We&#8217;ve added two new and empty exclude files in the .\/config sub folder for your convenience.\u00a0\u00a0 &nbsp;Support for new Sigma Modifiers THOR now supports the newest value modifiers used in the most recent version of the Sigma standard. endswith startswith Case ID (CID) get [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[46,32],"tags":[6,82,7,78,101,5,48],"class_list":["post-5020","post","type-post","status-publish","format-standard","hentry","category-newsletter","category-thor","tag-apt","tag-ioc","tag-scanner","tag-scanning","tag-signatures","tag-thor","tag-yara"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Changes in Upcoming THOR Version 10.3 - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"Changes in Upcoming THOR Version 10.3\",\"datePublished\":\"2019-12-04T11:56:26+00:00\",\"dateModified\":\"2022-03-25T13:14:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/\"},\"wordCount\":835,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"apt\",\"ioc\",\"scanner\",\"scanning\",\"signatures\",\"thor\",\"YARA\"],\"articleSection\":[\"Newsletter\",\"THOR\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/\",\"name\":\"Changes in Upcoming THOR Version 10.3 - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2019-12-04T11:56:26+00:00\",\"dateModified\":\"2022-03-25T13:14:59+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Changes in Upcoming THOR Version 10.3 - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"Changes in Upcoming THOR Version 10.3","datePublished":"2019-12-04T11:56:26+00:00","dateModified":"2022-03-25T13:14:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/"},"wordCount":835,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["apt","ioc","scanner","scanning","signatures","thor","YARA"],"articleSection":["Newsletter","THOR"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/","url":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/","name":"Changes in Upcoming THOR Version 10.3 - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2019-12-04T11:56:26+00:00","dateModified":"2022-03-25T13:14:59+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2019\/12\/04\/changes-in-upcoming-thor-version-10-3\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/5020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=5020"}],"version-history":[{"count":15,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/5020\/revisions"}],"predecessor-version":[{"id":7211,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/5020\/revisions\/7211"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=5020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=5020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=5020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}