¶ Trawler
https://github.com/joeavanzato/Trawler
¶ Overview
Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items, Binary Modifications and more.
Currently, trawler can detect most of the persistence techniques specifically called out by MITRE and Atomic Red Team with more detections being added on a regular basis.
¶ Features
- Scanning Windows OS for a variety of persistence techniques (Listed below)
- CSV Output with MITRE Technique and Investigation Jumpstart Metadata
- Analysis and Remediation Guidance Documentation
- Dynamic Risk Assignment for each detection
- Built-in Allow Lists for common Windows configurations spanning Windows 10/Server 2012|2016|2019|2022 to reduce noise
- Capture persistence metadata from 'golden' enterprise image (snapshot) for use as a dynamic allow-list at runtime
- Analyze mounted disk images via drive re-targeting
¶ How to start?
You can find this here.