InQuest provides the ability to integrate several sandboxes and automated malware analysis engines. Possibilities include Cuckoo Sandbox, FireEye, VMRay Analyzer, Joe Sandbox, and Falcon. These tools perform in-depth, dynamic analysis of malware in a controlled environment, extracting characteristics that may be hidden from static analysis of the files. Tools can be configured to be enabled, disabled, or only to run for certain filetypes. Results are automatically fed into the InQuest Threat Score Engine for score calculation and assignment.

Third-party integrations provide the perfect balance of detection between executable malware and the prolific doucument-based attacks.

Click below to learn more about how our sandbox integrations commodotize the AV industry and can provide insight into the threats impacting your organization.

Read more

YARA For Everyone: Sharing is Caring

This is the first post in an ongoing series about YARA and its exceptional ability to carve inside of binaries, documents, photos, and other types of files to uncover and match patterns. The additional posts in the series will give anyone who is thinking about gaining YARA skills the ability to start from scratch and get comfortable with the tool's functionality.

Read more

In case you missed it.

Snake Oilers 7 part 2: Assetnote.io launch, InQuest and Aiculus.

Risky.biz podcast where Pedram Amini discusses how InQuest reassembles files from network packets captured off the wire or funnelled in through ICAP and then rips them to bits looking for badness.

Read more

searchbook

A Firefox extension for executing some Graph-like searches against Facebook.

Read more

ripgrep-all

rga is a line-oriented search tool that allows you to look for a regex in a multitude of file types. rga wraps the awesome ripgrep and enables it to search in pdf, docx, sqlite, jpg, zip, tar.gz, movie subtitles.

Read more

TRISIS Group, Known for Physical Destruction, Targets U.S. Electric Companies

the APT group behind the TRISIS industrial control system (ICS) event, has expanded its focus beyond the oil and gas industries, according to researchers. The group has recently been seen probing the networks of electric utility organizations in the U.S. and elsewhere.

Read more

A quarter of major CMSs use outdated MD5 as the default password hashing scheme

Over a quarter of all the major content management systems (CMSs) use the old and outdated MD5 hashing scheme as the default for securing and storing user passwords.

Read more

U.S. Escalates Online Attacks on Russia’s Power Grid

The United States is stepping up digital incursions into Russia’s electric power grid in a warning to President Vladimir V. Putin and a demonstration of how the Trump administration is using new authorities to deploy cybertools more aggressively, current and former government officials said.

Read more