Nextron Thor

THOR is a sophisticated and flexible compromise assessment tool. Incident response engagements often begin with a group of compromised systems and an even bigger group of systems that are possibly affected. The manual analysis of many forensic images can be challenging. THOR speeds up this forensic analysis with more than 17,000 handcrafted YARA signatures, 400 Sigma rules, numerous anomaly detection rules and thousands of IOCs. THOR highlights suspicious elements, reduces the workload and speeds up forensic analysis in moments in which getting quick results is crucial.

THOR focuses on everything the Antivirus misses. With its huge signature set of thousands of YARA and Sigma rules, IOCs, rootkit and anomaly checks, THOR covers all kinds of threats. THOR does not only detect the backdoors and tools attackers use but also outputs, temporary files, system configuration changes and other traces of malicious activity.

THOR monitors the systems’ resources during the scan. If the available free main memory drops below a certain threshold, THOR stops the scan and exits with a warning. It automatically applies throttling if it detects low hardware resources and disables features that could affect the systems’ stability.

Nextron now offers a scan mode named “Thunderstorm” that has been integrated into preview builds of the THOR version 10.6. This mode of operation turns THOR into a RESTful web service that is able to process thousands of samples per minute sent from any device within the network.

And alternatively, THOR Cloud is a lightweight and easy to deploy on-demand compromise assessment scanner. THOR Cloud eliminates the need for on-premise systems for licensing and scanner package downloads.