Sigma is a community effort to write detections for IoC’s, and now with DRONE, you can scan these IoC’s on a live machine. Typically, these Sigma rules are designed to be executed or scanned on SIEM logs but with DRONE, you can find these IoC’s directly on the live machine. We have also added attributions, so the name of the rule creator will be visible in the detection details.
Sigma public repository synchronization
Running Sigma rules on a live machine is one of the key benefits of DRONE. Staying up to date with the latest public Sigma repositories is easy with the Sigma public repository synchronization feature. If there are any new rules available, instead of adding them manually, just use the sync feature and DRONE will automatically support them.
How to run SIGMA rules in DRONE?
Simple. Run DRONE from the command line and add the following command:
DRONE-1.7.0-x86.exe –sync-sigma
Automatically all Sigma rules from the SigmaHQ repository will be available in DRONE and you can use them to run either on a live machine or on an uploaded evidence file.
DRONE is multi-functional
Besides running Sigma rules live on a machine, DRONE contains features that will automate your workflow and speed up the investigation process. What takes your analysts hours or days, DRONE does in minutes. It is like having your own virtual 24/7 available DFIR expert.
You can use DRONE for:
- Fully remote endpoint assessment
- Ultra-fast Early Case Assessments
- Automated Compromise Assessments
- Rapid keyword searching of forensic evidence
- Anomaly Detection on endpoint forensic data
- Sigma and YARA rule Scanning
- Decreasing preliminary analysis time to minutes
- Supporting analysts with less experience to make informed decisions
To learn more or get access to DRONE, visit www.binalyze.com/drone.
DRONE is now also available in Binalyze’s flagship product AIR which makes it possible to acquire over 150 digital evidence types, analyze the acquired evidence, and create a structured, complete, and simple to share case report in less than 10 minutes. All from one place in a remote and scalable way.
You can check the demo here
