CROWDSTRIKE FALCON™ ORCHESTRATOR
Extendable Workflow Automation & Real-Time Security Forensics and Remediation
Falcon Orchestrator is an open source tool built on CrowdStrike’s Falcon Connect APIs. Customers can take advantage of powerful workflow automation and case management capabilities, as well as extendable wide range of security forensics and remediation actions which work in conjunction with and complement the capabilities of CrowdStrike Falcon.
CROWDSTRIKE SHELLSHOCK SCANNER
Network Scan for Bash Vulnerability
CrowdStrike ShellShock Scanner is a free tool aimed to help alert you to the presence of systems on your network that are vulnerable to the Bash ShellShock vulnerability.
Supported Operating Systems: The tool runs on both 32 bit and 64 bit versions of Windows from XP and above.
CROWDSTRIKE HEARTBLEED SCANNER
Network Scan for OpenSSL Vulnerability
CrowdStrike Heartbleed Scanner is a free tool aimed to help alert you to the presence of systems (such as web servers, VPNs, secure FTP servers, databases, routers, etc.) on your network that are vulnerable to the OpenSSL Heartbleed vulnerability.
Supported Operating Systems: The tool runs on both 32 bit and 64 bit versions of Windows from XP and above.
CROWD RESPONSE
Static Host Data Collection Tool
Crowd Response is a lightweight Windows console application designed to aid in the gathering of system information for incident response and security engagements. The application contains numerous modules, each of them invoked by providing specific command line parameters to the main application. Modules are all built into the main application in C++ language utilizing the Win32 API to achieve their functionality.
Crowd Response results may be viewed in a variety of ways, particularly when leveraging CrowdStrike’s CRconvert. By default, output from Crowd Response is provided in an XML file. CRconvert will flatten this XML to CSV, TSV or HTML, if desired. The various format options were created to support the different needs and analysis preferences of the end user.
Supported Operating Systems: The tool runs on 32 bit and 64 bit versions of Windows from XP and above.
TORTILLA
Anonymous Security Research through Tor
Tortilla is an open source tool that allows users to securely, anonymously, and transparently route all TCP/IP and DNS traffic through Tor, regardless of the client software, and without relying on VPNs or additional hardware or virtual machines.
Supported Operating Systems: The tool runs on 32 bit and 64 bit versions of Windows from XP and above.
CROWD DETOX
Decompilation Deobfuscator
The CrowdDetox plugin for Hex-Rays automatically removes junk code and variables from Hex-Rays function decompilations. This allows security researchers to analyze malware more easily, efficiently, and effectively.
Supported Operating Systems: This distribution comes with pre-built versions of the plugin for Windows, Mac OS, and Linux.
CROWD INSPECT
Host-Based Process Inspection
CrowdInspect is a free community tool for Microsoft Windows systems that is aimed to help alert you to the presence of potential malware are on your computer that may be communicating over the network. It is a host-based process inspection tool utilizing multiple sources of information to detect untrusted or malicious network-active process. The tool is leveraging intelligence from VirusTotal, Web of Trust (WOT), and Team Cymru’s Malware Hash Registry.
Supported Operating Systems: The tool runs on both 32 bit and 64 bit versions of Windows from XP and above.
CrowdInspect. Version 1.5.0.0:
- CrowdInspect now analyzes all processes, not just those communicating over the network. Uncheck the TCP and UDP buttons to see only those processes not communicating on the network.
- Bug fixes, including better parsing of VirtusTotal results.