As we are mere hours away from celebrating 2013, we'd like to
focus today on M-Unition's Armory channel. The Armory is the place
to be if you want to be the first to find out about the latest
releases, free tools and of course, our ever popular M-Trends
report. The most popular posts in this category are listed below for
your reading pleasure.
target="_blank">New Product Offering: Mandiant Cloud
Alert
This past year we made several product
announcements, but this one was especially rewarding. When you deal
with cybersecurity risks on a daily basis you need tools to help you
see activity in real time. At MIRcon ™ 2012, we announced our newest
product offering: Mandiant Cloud Alert™. Mandiant Cloud Alert is a
powerful tool, enabling organizations to identify malicious
communication, audit existing security measures, monitor how the
organization is trending over time, and track incidents in their
network.
Memory Analysis - Introducing Memoryze™ for the Mac
1.0
target="_blank">Memoryze™ for the Mac 1.0, which brings memory
imaging and analysis to the Mac, joins a growing list of
target="_blank">freeware tools Mandiant provided this past
year.
Memoryze for the Mac 1.0 brings many of the features of
target="_blank">Memoryze™ to the Apple Macintosh platform. This
new tool enables acquisition of memory images via the command-line
or a simple GUI. In addition, Memoryze for the Mac 1.0 can perform
offline analysis against memory images or live analysis on a running
system.
target="_blank">Leveraging the Application Compatibility Cache
in Forensic Investigations
Freeware tool,
target="_blank">Shim Cache Parser™, was developed in the
course of our incident response investigations, according to
Mandiant's Andrew Davis.
During keyword searches of
compromised systems, the Mandiant team discovered known malicious
file names in the Windows Registry. Further research showed the
cache data was generated by the Windows Application Compatibility
Database. Along with these file names, other types of file metadata
can be recovered such as file size, file last modified times, and
last execution time, depending on the operating system version. This
data can be very useful during an incident response. It helps
identify which systems an attacker may have executed malware on and
can also provide information about the time that it may have
occurred.
Shim Cache Parser is the proof-of-concept tool we
developed to extract this useful forensic evidence. You can download
it target="_blank">here.
target="_blank">Mandiant Introduces Reverse-Proxy Open Source
Tool
Mandiant's Sean Cunningham and Mark Thomas discuss
the availability of a highly efficient reverse HTTP(S) proxy called
simply 'RProxy™'. Mandiant released RProxy as an open sources tool
to encourage the general community to participate in its evolution.
You can download the tool
target="_blank">here.
target="_blank">M-Trends: The One Threat Report You Need to
Read
Each year Mandiant takes a look back at
engagements we've responded to and puts together trends that help
you fight back against targeted threats. On March 6th, we released
our latest M-Trends report,
target="_blank">An Evolving Threat, which revealed key
insights, statistics and case studies illustrating how the tools and
tactics of targeted attackers, including the Advanced Persistent
Threat (APT), have evolved over the last year. We're currently
working on the 2013 edition of M-Trends and plan to release it at
2013.