Alert : CISA Hunt and Incident Response Program (CHIRP) Detection Tool : Detecting Threats

Alert : CISA : CISA Hunt and Incident Response Program (CHIRP) Detection Tool : Detecting Threats

Alert (AA21-077A)
Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool

This Alert announces the CISA Hunt and Incident Response Program (CHIRP) tool. CHIRP is a forensics collection tool that CISA developed to help network defenders find indicators of compromise (IOCs) associated with activity detailed in the following CISA Alerts:

CISA advises organizations to use CHIRP to:

Examine Windows event logs for artifacts associated with this activity;
Examine Windows Registry for evidence of intrusion;
Query Windows network artifacts; and
Apply YARA rules to detect malware, backdoors, or implants.
Network defenders should review and confirm any post-compromise threat activity detected by the tool. CISA has provided confidence scores for each IOC and YARA rule included with CHIRP’s release. For confirmed positive hits, CISA recommends collecting a forensic image of the relevant system(s) and conducting a forensic analysis on the system(s).

[kennykonjo]

Salute Bro, You have been putting out excellent information 🙏🏽