Threatsniper (Formerly - ThreatInvestigator)

This will be the main thread for ThreatInvestigator, which is an upcoming security tool intended for malware analysts and quick incident response.




It provides a unified view of the following information in one single tool,
speeding up identification of threats and remediation of potential incidents:

Outbound connections per process
Cloud-based reputation checks
Advanced IP address to hostname matching
Integrated VirusTotal process lookups
Integrated VirusTotal IP address lookups
VirusTotal lookups in airgapped machines (!)
Instant toggling up/down status of all network interfaces
(Additional modules are in the pipeline)

A couple of free licenses will soon be available for early Wilders users.

 

Looks interesting!

How do we apply for that?

 

cool thanks

 

Is it not similar to CrowdInspect?

 

Count me in please

 

Interesting project. Thanks for the heads up

 

This does look interesting. I think it's a good addition to any existing security setup.

 

@svenfaw - Nice! Very useful

Thanks for Posting!

 

Thanks. I will post more details about this in the next few days.

 

Interesting - I was not aware of that tool, thanks for bringing it to my attention. Although both applications do seem to be in the same category, some features of ThreatInvestigator have a more targeted and forensic approach, with a specific focus at helping analysts (and advanced users) quickly evaluate and respond to potential threats.

 

First public version coming soon!
One more screenshot:




5 free one-year licenses will be offered to early Wilders users. To qualify, just send me a PM, briefly explaining in what context you will use the application, and why you believe you may find it interesting.

 

Thanks for reply Both apps can be very useful in right hands.

 

How bout a trial version? Not encouraging mass distribution but..........why not.

 

Release candidate 1 is available at https://www.metasudo.com/.

Note that the build is time-limited but another build will be available in the next few days.

Thanks for trying it. Bug reports, general feedback and feature suggestions are more than welcome.

Note: The first general release version is scheduled to ship about a month from now (and the free one-year licenses will then be provided to the users who have requested them).

 

Thank you

 

Think this is going to be very useful. Appreciate the efforts.

 

Just ran it short time ago. Looks like I have no threats on my system.

 

Seems to connect to: ghs-vip-any-c46.ghs-ssl.googlehosted.com

 

That's VirusTotal:

 

Could you confirm if the screenshot was taken after pressing the Scan button?

 

OK...if you say so.

 

Must have been before, but here is one taken "after pressing the Scan button".

 

Nice! (No issues here; everything whitelisted or 0/73, 0/74, 0/75 on VirusTotal)

Will the name be ThreatInvestigator or ThreatSniper?

 

ThreatSniper - ThreatInvestigator was a little too long to my liking.


I am considering adding support for an "imphash" column. And many other features are in the pipeline!

 

Good to learn of. Wish you success and satisfaction. Again I say, really useful and interesting stats.