Fenrir IOC Scanner

Fenrir scans for the following Indicators of Compromise (IOCs):

• Hashes: MD5, SHA1, and SHA256 (utilizing md5sum, sha1sum, and sha -a 256).
• File Names: Performs substring matching against the full path (e.g., searching for temp/p.exe will match /var/temp/p.exe).
• Strings: Uses grep to search for specific strings within files.
• C2 Servers: Checks for Command and Control (C2) server strings within the output of lsof -i and lsof -i -n.
• Hot Time Frame: Uses stat to identify files created within a specific epoch time stamp range (min and max).

To maintain a low footprint on remote systems, Fenrir can be deployed using an Ansible playbook. The deployment pattern involves:

1. Creating a RAM drive on the remote system.
2. Copying the Fenrir binary to the remote system.
3. Executing the scan.
4. Retrieving the logs from the RAM drive.

This approach ensures that the tool leaves minimal traces on the target filesystem.

Fenrir is a Bash script used to scan Linux, Unix, and OSX systems for Indicators of Compromise (IOCs). To run a scan, execute the script and provide the starting directory for the recursive scan as a positional argument.

All scan settings (such as exclusions and IOC files) are configured directly within the header of the fenrir.sh script.

./fenrir.sh DIRECTORY

Fenrir is designed to be lightweight and requires no installation or agent. You can customize the scan behavior by modifying the configuration variables located in the header of the fenrir.sh script.

Configurable parameters include:

• Directory Exclusions: Directories to skip during the recursive walk.
• File Extensions: Specific extensions to include or target for scanning.
• File Size Exclusions: Limits to skip files that are too large/small to optimize scan speed.
• IOC Files: The source files containing the hashes, names, and strings to look for.