Kansa
Kansa copied to clipboard
Kansa Analysis: Autoruns VT hash lookup
Write an analysis script for looking up hashes from Autoruns and other collected data against Virus Total, maintain a local db of known good/bad so they don't have to be looked up.
More generically, VT lookups would be useful for any collector that returns file hashes, Get-Autorunsc.ps1, Get-ProcsWMI.ps1 both do, as does Get-FilesByHash.ps1, though in the latter case, the file being sought is already known to be malicious.