FastIR Collector – Windows Incident Response Tool


FastIR Collector is Windows incident response tool that offers the possibility to extract classic artefacts such as memory dump, auto-started software, MFT, MBR, Scheduled tasks, Services and records the results in csv files. The tool can also perform smart acquisitions thanks to the filecatcher, certificate filtering or support of Yara rules.

FastIR Collector - Windows Incident Response Tool

The first part of the name “Fast” was chosen because one of the prerequisite before the beginning of the development was to be able to perform forensic collections as quickly as possible. A standard collection (without filecatcher or dump) takes less than 1 minute 30 seconds on a Windows 7 system.

FastIR is designed to counter the growing size of hard drives, traditional forensics tools can take several hours to make a copy of the data and the volume of the data may be too large to make a reasonably speedy analysis.

Features

FastIR looks for various artefacts, including (but not limited to):

  • Drive Identification – Archives all PE files not signed by Microsoft in Windows directories.
  • Persistence Identification – Collects several persistence mechanisms.
  • Named Pipes Identification – Rootkits often use named pipes to communication between components.
  • Virtual File Systems – Collects & analyses Windows Prefetch files.
  • Malware Identification – Using various artefacts and techniques.
  • Process & Injection Identification – Able to identify various RATs, malware and rootkits from these artefacts.

The full documentation can be found here – FastIR_Documentation.pdf

Requirements

If you aren’t using the prebuilt exe:

  • pywin32
  • python WMI
  • python psutil
  • python yaml
  • construct
  • distorm3
  • hexdump
  • pytz

There is also a more extensive paper about the tool here: FastIR-Collector-on-advanced-threats_v1.5.pdf

You can download FastIR Collector here:

FastIR_x64.exe
FastIR_x86.exe

Or read more here

Posted in: Forensics, Security Software, Windows Hacking

,


Latest Posts:


dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).
WiFi-Dumper - Dump WiFi Profiles and Cleartext Passwords WiFi-Dumper – Dump WiFi Profiles and Cleartext Passwords
WiFi-Dumper is an open-source Python-based tool to dump WiFi profiles and cleartext passwords of the connected access points on a Windows machine.
truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.


Comments are closed.