ThreatPursuit-VM - Threat Pursuit Virtual Machine (VM): A fully custo

项目说明

_______________________________________________________________________

__ __ __
_/ |_| |_________ ____ _____ _/ |_
\ __| | \_ __ _/ __ \\__ \\ __\
| | | Y | | \\ ___/ / __ \| |
|__| |___| |__| \___ (____ |__|
______ __ _________ ________ __|___/ |
\____ \| | \_ __ / ___| | | \ __\
| |_> | | /| | \\___ \| | | || |
| __/|____/ |__| /____ |____/|__||__|
|__| \/

MANDIANT THREAT INTELLIGENCE VM
2020.1

_______________________________________________________________________

Created by:
Dan Kennedy
Jake Barteaux
Blaine Stancill
Nhan Huynh
Front Line Ad Research and Expertise

Pre-Requisites
-----------

Google Chrome Browser

Oracle Java SE 11 or Greater

Installation (Install Script)
--------------

Requirements
-----------

Recommended
-----------

* Windows 10 1903
* 120+ GB Hard Drive
* 8+ GB RAM
* 1 network adapters
* 1024mb Graphics Card Memory
* Enable support for for Docker)

Known Issues
-----------
Using Oracle as the software running from a Windows 10 physical host, will cause issues with the Docker install. There is currently no workaround other than using Player or Workstation.

Instructions
-----------

Standard install

1. Create and configure a new Windows Machine
2. Ensure VM is updated completely. You may have to check for updates, reboot, and check again until no more remain
3. Take a snapshot of your machine!
4. Download and copy install.ps1 on your newly configured machine.
5. Open PowerShell as an Administrator
6. Unblock the install file by running Unblock-File .\install.ps1
7. Enable script execution by running Set-ExecutionPolicy Unrestricted -f
8. Finally, execute the installer script as follows:
.\install.ps1
You can also pass your password as an argument: .\install.ps1 -password <password>
The script will set up the Boxstarter en and proceed to download and install the ThreatPursuit . You will be prompted for the administrator password in order to automate host restarts during installation. If you do not have a password set, hitting enter when prompted will also work.

Installed Tools
-----------

De, Analytics and Machine Learning

Triage, Modelling & Hunting

Ad Emulation

Information Gathering

Utilities and Links

项目信息

开发语言：PowerShell

Star 数：1303

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。