FastIR Collector - Windows Incident Response Tool

2016-01-29T20:30:15
ID KITPLOIT:2529687755602567630
Type kitploit
Reporter KitPloit
Modified 2016-01-29T20:30:15

Description

This tool collects different artefacts on live Windows and records the results in csv files. With the analyses of this artefacts, an early compromission can be detected.

Requirements

  • pywin32
  • python WMI
  • python psutil
  • python yaml
  • construct
  • distorm3
  • hexdump
  • pytz

Execution

  • ./fastIR_x64.py -h for help
  • ./fastIR_x64.py --packages all extract all artefacts without dump package artefacts
  • ./fastIR_x64.py --packages dump --dump mft to extract MFT
  • ./fastIR_x64.py --packages all --ouput_dir your_ouput_dir to set the directory output (by default is the current directory)
  • ./fastIR_x64.py --profile you_file_profile to set your own profile extraction

Packages
Packages Lists and Artefact

Download Fastir_Collector