Kansa icon indicating copy to clipboard operation
Kansa copied to clipboard

Kansa Analysis: Autoruns VT hash lookup

Open davehull opened this issue 11 years ago • 1 comments

Write an analysis script for looking up hashes from Autoruns and other collected data against Virus Total, maintain a local db of known good/bad so they don't have to be looked up.

davehull avatar Jun 16 '14 03:06 davehull

More generically, VT lookups would be useful for any collector that returns file hashes, Get-Autorunsc.ps1, Get-ProcsWMI.ps1 both do, as does Get-FilesByHash.ps1, though in the latter case, the file being sought is already known to be malicious.

davehull avatar Jul 31 '14 16:07 davehull