-1

I need to design a solution that will allow me to submit a series of MD5 hashes and then be alerted if these hashes are found on any machine (Windows) on the network. I'm open to existing solutions (probably preferred).

I frequently use tools such as EnCase or FTK in conjuction with file hashes to do several things (identify known bad files, exclude known good files, etc.). However, neither of these tools is ideal for a large network scan although there is some capability there.

For example, it would be ideal if A/V like SEP could be configured to do this. It's already installed and it's already reading the files dureing scans or other events. Whatever the solution, it seems like it should involve an agent on the target of the scan. We can't pull each file and hash it. It should happen on the client with just the results reported.

Any/all help is appreciated. Thanks!

1 Answer 1

-1

I don't know of any automatic solution that does this, but here are two ideas from the top of my head:

  • ClamAV is open-source: there's likely a way to modify (or maybe even to use it out of the box) so it does just what you want by. Maybe by setting up a local signature update repository?
  • Yara seems like a good candidate as well, although it can't fetch signatures by itself. You'll need to do some scripting.

Basically, you have two signature matching engines here that will take care of the tedious system-wide scanning process. What you have to do from here is to take care of the automation. Depending on your network configuration, it can go from a couple of python lines and a cron-job to GPOs, I guess.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.