rastrea2r: Collecting & Hunting for IOCs with gusto and style

$git clone https://github.com/rastrea2r/rastrea2r.git



$make venv

$source /Users/ssbhat/.venvs/rastrea2r/bin/activate

$cd src/rastrea2r/server/

$python rastrea2r_server_v0.3.py

Bottle v0.12.13 server starting up (using WSGIRefServer())...

Listening on http://0.0.0.0:8080/$cd src/rastrea2r/server/

$python rastrea2r_osx_v0.3.py -h

usage: rastrea2r_osx_v0.3.py [-h] [-v] {yara-disk,yara-mem,triage} ...



Rastrea2r RESTful remote Yara/Triage tool for Incident Responders



positional arguments:  {yara-disk,yara-mem,triage}



modes of operation

 yara-disk           Yara scan for file/directory objects on disk

 yara-mem            Yara scan for running processes in memory

 triage              Collect triage information from endpoint



optional arguments:

 -h, --help            show this help message and exit

 -v, --version         show program's version number and exit





Further more, the available options under each command can be viewed by executing the help option. i,e



$python rastrea2r_osx_v0.3.py yara-disk -h

usage: rastrea2r_osx_v0.3.py yara-disk [-h] [-s] path server rule



positional arguments:

path          File or directory path to scan

server        rastrea2r REST server

rule          Yara rule on REST server



optional arguments:

-h, --help    show this help message and exit

-s, --silent  Suppresses standard output