mandiant/ThreatPursuit-VM

PowerShell

전체 #51,107 PowerShell #150 Data Science #1,503 Analytics Engines #472

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

cyberthreatthreatintelligencethreathuntingintelligenceintelligence-analysisdata-scienceanalyticsmalwarevirtual-machinemandiantfireeye

주요 지표

스타 성장

스타

1.3k

포크

262

주간 성장

이슈

5001k

2020년 10월2021년 9월2022년 9월2023년 9월2024년 9월2025년 9월2026년 9월

README

      __   __                         __      
    _/  |_|  |_________  ____ _____ _/  |_    
    \   __|  |  \_  __ _/ __ \\__  \\   __\   
     |  | |   Y  |  | \\  ___/ / __ \|  |     
     |__| |___|  |__|   \___  (____  |__|     
     ______  __ _________ ________ __|___/  |
     \____ \|  |  \_  __ /  ___|  |  |  \   __\
     |  |_> |  |  /|  | \\___ \|  |  |  ||  |
     |   __/|____/ |__| /____  |____/|__||__|
     |__|                    \/

            MANDIANT THREAT INTELLIGENCE VM
                   Version 2020.1
              threatpursuit@fireeye.com

                     Created by:
                     Dan Kennedy
              Jake Barteaux @day1player
          Blaine Stancill @MalwareMechanic
                     Nhan Huynh
      Front Line Advanced Research and Expertise

Pre-Requisites

Google Chrome Browser

Oracle Java SE 11 or Greater

Installation (Install Script)

Requirements

Known Issues

Using Oracle Virtualbox as the virtualisation software running from a Windows 10 physical host, will cause issues with the Docker install. There is currently no workaround other than using VMware Player or VMware Workstation.

Instructions

Standard install

Create and configure a new Windows Virtual Machine
Ensure VM is updated completely. You may have to check for updates, reboot, and check again until no more remain
Take a snapshot of your machine!
Download and copy install.ps1 on your newly configured machine.
Open PowerShell as an Administrator
Unblock the install file by running Unblock-File .\install.ps1
Enable script execution by running Set-ExecutionPolicy Unrestricted -f
Finally, execute the installer script as follows: .\install.ps1 You can also pass your password as an argument: .\install.ps1 -password The script will set up the Boxstarter environment and proceed to download and install the ThreatPursuit VM environment. You will be prompted for the administrator password in order to automate host restarts during installation. If you do not have a password set, hitting enter when prompted will also work.

Installed Tools

Development, Analytics and Machine Learning

Shogun
Tensorflow
Pytorch
Rstudio
RTools
Darwin
Keras
Apache Spark
Elasticsearch
Kibana
Apache Zeppelin
Jupyter Notebook
MITRE Caret
Python (x64)

Visualisation

Constellation
Neo4J
CMAP

Triage, Modelling & Hunting

MISP
OpenCTI
Maltego
Splunk
Microsoft MSTIC Jupyter and Python Security Tools
MITRE ATT&CK Navigator
Cortex Analyzer
Greynoise API and GNQL
threatcrowd API
threatcmd
ViperMonkey
Threat Hunters Playbook
MITRE TRAM
SIGMA
YETI
Azure Zentinel
AMITT Framework

Adversarial Emulation

MITRE Calderra
Red Canary ATOMIC Red Team
Mordor Re-play Adversarial Techniques
MITRE Caltack Plugin
APTSimulator
FlightSim

Information Gathering

Maltego
nmap
intelmq
dnsrecon
orbit
FOCA