THOR Scanner User Manual

In this manual you can find all the information regarding THOR. This version of the manual focuses on our stable version of THOR, which is version 10.7. If you are looking for information on older versions, like 10.6, you can have a look here.

Contents:

• 1. What is THOR?
  • 1.1. Package
• 2. Requirements
  • 2.1. Operating Systems
  • 2.2. Update Servers
• 3. Before You Begin
  • 3.1. Licensing
  • 3.2. Upgrade THOR and Update The Signatures
  • 3.3. Define an Antivirus / EDR Exclusion
  • 3.4. Grant Full Disk Access on macOS
  • 3.5. Choose The Right THOR Variant
  • 3.6. Choose The Right Architecture
  • 3.7. Choose The Right Command Line Flags
  • 3.8. Add Command Line Completions (optional)
  • 3.9. Verify Public Key Signatures (optional)
• 4. Deployment
  • 4.1. Licensing
  • 4.2. Network Share (Windows)
  • 4.3. ASGARD Management Center (Windows, Linux, macOS)
  • 4.4. Ansible (Linux)
  • 4.5. THOR Thunderstorm Service
  • 4.6. THOR Remote
  • 4.7. Distribute to Offline Networks / Field Offices
  • 4.8. System Load Considerations
• 5. Scan
  • 5.1. Quick Start
  • 5.2. Often Used Parameters
  • 5.3. Parameters possibly relevant for your Use Case
  • 5.4. Risky Flags
  • 5.5. Lesser Known But Useful Flags
  • 5.6. Help and Debugging
  • 5.7. Examples
  • 5.8. Run a Scan with Specific Modules
  • 5.9. Select or filter Signatures during Initialization
  • 5.10. PE-Sieve Integration
  • 5.11. Multi-Threading
• 6. Scan Modes
  • 6.1. Modules
  • 6.2. Features
• 7. Special Scan Modes
  • 7.1. Lab Scanning
  • 7.2. Lookback Mode
  • 7.3. Drop Zone Mode
  • 7.4. Image File Scan Mode
  • 7.5. DeepDive
  • 7.6. Eventlog Analysis
  • 7.7. MFT Analysis
• 8. Analysis
  • 8.1. ASGARD Analysis Cockpit
  • 8.2. Splunk
  • 8.3. THOR Util Report Feature
  • 8.4. Log Analysis Manual
• 9. Configuration
  • 9.1. Scan Templates
  • 9.2. CPU Limit (--cpulimit) Explained
  • 9.3. Maximum File Size
  • 9.4. Exclude Elements
• 10. Output Options
  • 10.1. Scan Output
  • 10.2. Syslog or TCP/UDP Output
  • 10.3. Encrypted Output Files
• 11. Update
  • 11.1. Update Locations
  • 11.2. Update Server Information
• 12. Custom Signatures
  • 12.1. Simple IOCs
  • 12.2. Rules
  • 12.3. STIX IOCs
  • 12.4. Enhance YARA Rules with THOR Specific Attributes
• 13. Other Topics
  • 13.1. License Retrieval
  • 13.2. Evidence Collection
  • 13.3. Resource Control
  • 13.4. Scoring System
  • 13.5. Action on Match
  • 13.6. THOR DB
  • 13.7. Archive Scan
• 14. Command Line Options
  • 14.1. Scan Options
  • 14.2. Scan Modes
  • 14.3. Resource Options
  • 14.4. Special Scan Modes
  • 14.5. Thor Thunderstorm Service
  • 14.6. License Retrieval
  • 14.7. Active Modules
  • 14.8. Module Extras
  • 14.9. Active Features
  • 14.10. Feature Extras
  • 14.11. Output Options
  • 14.12. ThorDB
  • 14.13. Syslog
  • 14.14. Reporting and Actions
  • 14.15. THOR Remote
  • 14.16. Automatic Collection of Suspicious Files (Bifrost)
  • 14.17. VirusTotal Integration
  • 14.18. Debugging and Info
• 15. Debugging
  • 15.1. Collecting a Diagnostcs Pack
  • 15.2. Debugging Examples
  • 15.3. Finding Bottlenecks
  • 15.4. Most Frequent Causes of Missing Alerts
  • 15.5. Most Frequent Causes of Frozen Scans
  • 15.6. Most Frequent Causes of Failed Scans
  • 15.7. Help Us With The Debugging
• 16. Analysis and Info
  • 16.1. Log Analysis Manual
  • 16.2. VALHALLA Rule Lookup
  • 16.3. Rule List Output
• 17. Use Cases
  • 17.1. Disk Image Analysis
  • 17.2. Memory Image Analysis with Volatility
  • 17.3. Scanning a Fileserver
• 18. Known Issues
  • 18.1. THOR#003: No rules with DEEPSCAN tag found
  • 18.2. THOR#002: THOR in Lab-Mode does not scan network or external drives
  • 18.3. THOR#001: Could not parse sigma logsources
• 19. Links and References
  • 19.1. Open Source License Acknowledgements
• 20. Changelog
  • 20.1. THOR 10.7.21
  • 20.2. THOR 10.7.20
  • 20.3. THOR 10.7.19
  • 20.4. THOR 10.7.18
  • 20.5. THOR 10.7.17
  • 20.6. THOR 10.7.16
  • 20.7. THOR 10.7.15
  • 20.8. THOR 10.7.14
  • 20.9. THOR 10.7.13
  • 20.10. THOR 10.7.12
  • 20.11. THOR 10.7.11
  • 20.12. THOR 10.7.10
  • 20.13. THOR 10.7.9
  • 20.14. THOR 10.7.8
  • 20.15. THOR 10.7.7
  • 20.16. THOR 10.7.6
  • 20.17. THOR 10.7.5
  • 20.18. THOR 10.7.4
  • 20.19. THOR 10.7.3
  • 20.20. THOR 10.7.2
  • 20.21. THOR 10.7.1
  • 20.22. THOR 10.7.0

Indices and tables

• Search Page