{"id":8612,"date":"2020-08-31T18:52:33","date_gmt":"2020-08-31T16:52:33","guid":{"rendered":"https:\/\/www.nextron-systems.com\/?p=8612"},"modified":"2022-03-25T14:15:43","modified_gmt":"2022-03-25T13:15:43","slug":"introduction-thor-techpreview","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/","title":{"rendered":"Introduction THOR TechPreview"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<p>Since its early days, THOR has always been focused on stability and detection rate. With the early module and feature set, we never had to make a compromise.\u00a0<\/p>\n<p>However, during the last 1-2 years, we had to make some decisions on the integration of new features and their default state in favor of stability. These decisions include e.g. the process dump feature, the PE-Sieve integration and Sigma scanning.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/Screenshot-2020-08-31-at-15.26.57.png&#8221; title_text=&#8221;Screenshot 2020-08-31 at 15.26.57&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<p>Detection and stability have become two competing goals. We do not want to make these hard decisions anymore and leave them to you. You decide, based on your use case, if you want to use the version with newest features and detection capabilities or the one with a maximum of stability.\u00a0<\/p>\n<p>With THOR version 10.6 we introduce a version named THOR TechPreview, which includes the newest features, refactored modules and new modes of operation.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/Screenshot-2020-08-31-at-14.55.40.png&#8221; title_text=&#8221;Screenshot 2020-08-31 at 14.55.40&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_testimonial author=&#8221;Florian Roth&#8221; job_title=&#8221;Head of Research&#8221; portrait_url=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/IMG_8807_0-5_Snapseed_small.png&#8221; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221; hover_enabled=&#8221;0&#8243; body_text_color=&#8221;#000000&#8243; quote_icon_color=&#8221;#009ec7&#8243; sticky_enabled=&#8221;0&#8243;]<\/p>\n<p>THOR TechPreview is a special THOR version that contains the newest modules and great detection features, which have not yet been tested on thousands of systems.<\/p>\n<p>[\/et_pb_testimonial][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<p>The first release of THOR TechPreview will be version 10.6.<br \/> The standard version of THOR remains version 10.5 until the refactored and new features of the TechPreview have been proved to be stable. The expected release cycles of new version of THOR Tech Preview will be once a month, while new minor versions of THOR will be released only twice a year. Both versions receive bugfix updates and use the same signature set.\u00a0<\/p>\n<p>[\/et_pb_text][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/Screenshot-2020-08-31-at-14.48.33.png&#8221; title_text=&#8221;Screenshot 2020-08-31 at 14.48.33&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;1_3,1_3,1_3&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;1_3&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_blurb title=&#8221;ASGARD and THOR TechPreview&#8221; image=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/Screenshot-2020-08-31-at-15.35.20.png&#8221; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<p>The current ASGARD Management Centers continue to use the standard THOR versions. The next minor release ASGARD 2.6, which is planned for October 2020, includes the option to use the TechPreview variant.\u00a0\u00a0<\/p>\n<p>[\/et_pb_blurb][\/et_pb_column][et_pb_column type=&#8221;1_3&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_blurb title=&#8221;Recommended Use Cases&#8221; image=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/Screenshot-2020-08-31-at-15.42.44.png&#8221; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<p>The TechPreview version is recommended for all use cases in which detection capabilities have higher priority than stability. We would e.g. always recommend the TechPreview for image scans in a forensics labs.<\/p>\n<p>[\/et_pb_blurb][\/et_pb_column][et_pb_column type=&#8221;1_3&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_blurb title=&#8221;Internal Testing&#8221; image=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/08\/Anti-virus-Security-15.png&#8221; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]THOR TechPreview is not an untested version. It still goes through our internal testing on almost a hundred different test systems in 4 different test configurations. [\/et_pb_blurb][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.0&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Getting Started<\/h1>\n<p>Customers can download the new THOR TechPreview version from the download section in the customer portal once it gets released. Thor-Util version 1.11+ also supports the TechPreview download. We&#8217;ve planned the release for September 8.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Since its early days, THOR has always been focused on stability and detection rate. With the early module and feature set, we never had to make a compromise.\u00a0 However, during the last 1-2 years, we had to make some decisions on the integration of new features and their default state in favor of stability. These decisions include e.g. the process dump feature, the PE-Sieve integration and Sigma scanning.\u00a0Detection and stability have become two competing goals. We do not want to make these hard decisions anymore and leave them to you. You decide, based on your use case, if you want to use the version with newest features and detection capabilities or the one with a maximum of stability.\u00a0 With THOR version 10.6 we introduce a version named THOR TechPreview, which includes the newest features, refactored modules and new modes of operation.\u00a0THOR TechPreview is a special THOR version that contains the newest modules and great detection features, which have not yet been tested on thousands of systems.The first release of THOR TechPreview will be version 10.6. The standard version of THOR remains version 10.5 until the refactored and new features of the TechPreview have been proved to be stable. The expected [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[46,32],"tags":[7,585,584,5,297],"class_list":["post-8612","post","type-post","status-publish","format-standard","hentry","category-newsletter","category-thor","tag-scanner","tag-split","tag-techpreview","tag-thor","tag-version"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Introduction THOR TechPreview - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"Introduction THOR TechPreview\",\"datePublished\":\"2020-08-31T16:52:33+00:00\",\"dateModified\":\"2022-03-25T13:15:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/\"},\"wordCount\":823,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"scanner\",\"split\",\"techpreview\",\"thor\",\"version\"],\"articleSection\":[\"Newsletter\",\"THOR\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/\",\"name\":\"Introduction THOR TechPreview - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2020-08-31T16:52:33+00:00\",\"dateModified\":\"2022-03-25T13:15:43+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Introduction THOR TechPreview - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"Introduction THOR TechPreview","datePublished":"2020-08-31T16:52:33+00:00","dateModified":"2022-03-25T13:15:43+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/"},"wordCount":823,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["scanner","split","techpreview","thor","version"],"articleSection":["Newsletter","THOR"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/","url":"https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/","name":"Introduction THOR TechPreview - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2020-08-31T16:52:33+00:00","dateModified":"2022-03-25T13:15:43+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2020\/08\/31\/introduction-thor-techpreview\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/8612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=8612"}],"version-history":[{"count":9,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/8612\/revisions"}],"predecessor-version":[{"id":8643,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/8612\/revisions\/8643"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=8612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=8612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=8612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}