diff --git a/conf/default/integrations.conf.default b/conf/default/integrations.conf.default index a129eab9560..578a4503f01 100644 --- a/conf/default/integrations.conf.default +++ b/conf/default/integrations.conf.default @@ -14,11 +14,6 @@ hwp = no # Number of workers for pool to run them in parallel max_workers = 6 -[mandiant_intel] -enabled = no -api_access = -api_secret = - # Create your apikey: https://threatfox.abuse.ch/api/#auth_key # MalwareBazaar uses this key too [abusech] diff --git a/conf/default/memory.conf.default b/conf/default/memory.conf.default index 52e34dac0b4..552f67073c6 100644 --- a/conf/default/memory.conf.default +++ b/conf/default/memory.conf.default @@ -10,80 +10,76 @@ delete_memdump = no # Delete memory dump in the event of a volatility exception delete_memdump_on_exception = no +# Masks. Data that should not be logged +# Just get this information from your plain VM Snapshot (without running malware) +# This will filter out unwanted information in the logs +[mask] +enabled = no +pid_generic = + + # List of available modules # enabled: enable this module # filter: use filters to remove benign system data from the logs # Filters are defined in the mask section at below # Scans for hidden/injected code and dlls -# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#malfind [malfind] enabled = no filter = on # Lists official processes. Does not detect hidden processes -# https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#pslist [pslist] enabled = no filter = off # Process listing in tree form. Does not detect hidden processes (Don't work currently in CAPE) -# https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#pstree [pstree] enabled = no filter = off # Lists hidden processes. Enumerate processes in the Kernel memory using pool tag scanning _POOL_HEADER -# https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#psscan [psscan] enabled = no filter = off # Show callbacks -# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#callbacks [callbacks] enabled = no filter = off # Show sids -# http://code.google.com/p/volatility/wiki/CommandReference23#getsids [getsids] enabled = no filter = off # Show privileges -# http://code.google.com/p/volatility/wiki/CommandReference23#privs [privs] enabled = no filter = off # Display processes' loaded DLLs- Does not display hidden DLLs -# http://code.google.com/p/volatility/wiki/CommandReference23#dlllist [dlllist] enabled = no filter = on # List open handles of processes -# http://code.google.com/p/volatility/wiki/CommandReference23#handles [handles] enabled = no filter = on # Scan for Mutexes (whole system) -# http://code.google.com/p/volatility/wiki/CommandReference23#mutantscan [mutantscan] enabled = no filter = on # Scan for services -# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#svcscan [svcscan] enabled = no filter = on # Scan for kernel drivers (includes hidden, unloaded) -# http://code.google.com/p/volatility/wiki/CommandReference23#modscan [modscan] enabled = no filter = on @@ -106,9 +102,144 @@ filter = off enabled = no filter = off -# Masks. Data that should not be logged -# Just get this information from your plain VM Snapshot (without running malware) -# This will filter out unwanted information in the logs -[mask] +# Not tested module below + +[info] enabled = no -pid_generic = +filter = off + +[psxview] +enabled = no +filter = off + +[ldrmodules] +enabled = no +filter = off + +[cmdline] +enabled = no +filter = off + +[envars] +enabled = no +filter = off + +[modules] +enabled = no +filter = off + +[driverscan] +enabled = no +filter = off + +[driverirp] +enabled = no +filter = off + +[verinfo] +enabled = no +filter = off + +[filescan] +enabled = no +filter = off + +[vadinfo] +enabled = no +filter = off + +[timers] +enabled = no +filter = off + +[hivelist] +enabled = no +filter = off + +[hashdump] +enabled = no +filter = off + +[lsadump] +enabled = no +filter = off + +[cachedump] +enabled = no +filter = off + +[symlinkscan] +enabled = no +filter = off + +[thrdscan] +enabled = no +filter = off + +[hollowprocesses] +enabled = no +filter = off + +[processghosting] +enabled = no +filter = off + +[suspiciousthreads] +enabled = no +filter = off + +[devicetree] +enabled = no +filter = off + +[consoles] +enabled = no +filter = off + +[cmdscan] +enabled = no +filter = off + +[amcache] +enabled = no +filter = off + +[shimcache] +enabled = no +filter = off + +[userassist] +enabled = no +filter = off + +[unloadedmodules] +enabled = no +filter = off + +[iat] +enabled = no +filter = off + +[skeletonkey] +enabled = no +filter = off + +[unhookedsyscalls] +enabled = no +filter = off + +[etwpatch] +enabled = no +filter = off + +[mftscan] +enabled = no +filter = off + +[svclist] +enabled = no +filter = off + +[svcdiff] +enabled = no +filter = off diff --git a/data/html/base-report.html b/data/html/base-report.html index f7d6a475ce5..4324c95da7a 100644 --- a/data/html/base-report.html +++ b/data/html/base-report.html @@ -1,81 +1,65 @@ - - +
- -{% if title %} -| ID | -Category | -Target | -MD5 | -Added | -Status | -
|---|---|---|---|---|---|
| {{row.id}} | -{{row.category|upper}} | -- {% if row.processed %} - - {% endif %} - - {% if row.category == "file" %} - {{os.path.basename(row.target)}} - {% elif row.category == "url" %} - {{row.target}} - {% endif %} - - {% if row.processed %} - - {% endif %} - | -- {% if row.category == "file" %} - {{row.md5}} - {% endif %} - | -{{row.added_on}} | -{{row.status}} | -
`s get reset. However, we also reset the\n// bottom margin to use `rem` units instead of `em`.\np {\n margin-top: 0;\n margin-bottom: $paragraph-margin-bottom;\n}\n\n// Abbreviations\n//\n// 1. Duplicate behavior to the data-* attribute for our tooltip plugin\n// 2. Add the correct text decoration in Chrome, Edge, IE, Opera, and Safari.\n// 3. Add explicit cursor to indicate changed behavior.\n// 4. Remove the bottom border in Firefox 39-.\n// 5. Prevent the text-decoration to be skipped.\n\nabbr[title],\nabbr[data-original-title] { // 1\n text-decoration: underline; // 2\n text-decoration: underline dotted; // 2\n cursor: help; // 3\n border-bottom: 0; // 4\n text-decoration-skip-ink: none; // 5\n}\n\naddress {\n margin-bottom: 1rem;\n font-style: normal;\n line-height: inherit;\n}\n\nol,\nul,\ndl {\n margin-top: 0;\n margin-bottom: 1rem;\n}\n\nol ol,\nul ul,\nol ul,\nul ol {\n margin-bottom: 0;\n}\n\ndt {\n font-weight: $dt-font-weight;\n}\n\ndd {\n margin-bottom: .5rem;\n margin-left: 0; // Undo browser default\n}\n\nblockquote {\n margin: 0 0 1rem;\n}\n\nb,\nstrong {\n font-weight: $font-weight-bolder; // Add the correct font weight in Chrome, Edge, and Safari\n}\n\nsmall {\n @include font-size(80%); // Add the correct font size in all browsers\n}\n\n//\n// Prevent `sub` and `sup` elements from affecting the line height in\n// all browsers.\n//\n\nsub,\nsup {\n position: relative;\n @include font-size(75%);\n line-height: 0;\n vertical-align: baseline;\n}\n\nsub { bottom: -.25em; }\nsup { top: -.5em; }\n\n\n//\n// Links\n//\n\na {\n color: $link-color;\n text-decoration: $link-decoration;\n background-color: transparent; // Remove the gray background on active links in IE 10.\n\n @include hover() {\n color: $link-hover-color;\n text-decoration: $link-hover-decoration;\n }\n}\n\n// And undo these styles for placeholder links/named anchors (without href).\n// It would be more straightforward to just use a[href] in previous block, but that\n// causes specificity issues in many other styles that are too complex to fix.\n// See https://github.com/twbs/bootstrap/issues/19402\n\na:not([href]):not([class]) {\n color: inherit;\n text-decoration: none;\n\n @include hover() {\n color: inherit;\n text-decoration: none;\n }\n}\n\n\n//\n// Code\n//\n\npre,\ncode,\nkbd,\nsamp {\n font-family: $font-family-monospace;\n @include font-size(1em); // Correct the odd `em` font sizing in all browsers.\n}\n\npre {\n // Remove browser default top margin\n margin-top: 0;\n // Reset browser default of `1em` to use `rem`s\n margin-bottom: 1rem;\n // Don't allow content to break outside\n overflow: auto;\n // Disable auto-hiding scrollbar in IE & legacy Edge to avoid overlap,\n // making it impossible to interact with the content\n -ms-overflow-style: scrollbar;\n}\n\n\n//\n// Figures\n//\n\nfigure {\n // Apply a consistent margin strategy (matches our type styles).\n margin: 0 0 1rem;\n}\n\n\n//\n// Images and content\n//\n\nimg {\n vertical-align: middle;\n border-style: none; // Remove the border on images inside links in IE 10-.\n}\n\nsvg {\n // Workaround for the SVG overflow bug in IE10/11 is still required.\n // See https://github.com/twbs/bootstrap/issues/26878\n overflow: hidden;\n vertical-align: middle;\n}\n\n\n//\n// Tables\n//\n\ntable {\n border-collapse: collapse; // Prevent double borders\n}\n\ncaption {\n padding-top: $table-cell-padding;\n padding-bottom: $table-cell-padding;\n color: $table-caption-color;\n text-align: left;\n caption-side: bottom;\n}\n\n// 1. Removes font-weight bold by inheriting\n// 2. Matches default `