sitrep: Extensible, configurable host triage
Extensible, configurable host triage.
SitRep is intended to provide a lightweight, extensible host triage alternative. Checks are loaded dynamically at runtime from stand-alone files. This allows operators to quickly modify existing checks, or add new checks as required.
Checks are grouped by category and can be marked as OpSec safe/unsafe. unsafe checks are only loaded if the /AllowUnsafe flag is provided.
Checks are separated into categories. This allows them to be displayed in appropriate groups. The following checks are currently available:
- CurrentUser.cs – the current user
- DomainName.cs – the domain name
- HostName.cs – the hostname
- LoggedOnUsers.cs – List all logged on users
- OSVersion.cs – OS version information
- VirtualEnvironment.cs – Checks if we are operating in a virtualised environment
- userEnvironmentVariables.cs – Grabs the environment variables applied to the current process
- SystemEnvironmentVariables.cs – Grabs system environment variables from the registry (HKLM)
- NameServers.cs – Gets the DNS servers for each network interface
- AVProcesses.cs – Checks if any known AV processes are running
- Integrity.cs – Get the integrity level of the current process
- LocalAdmin.cs – Check if we are a local admin
- Privileges.cs – List our current privileges.
- UACLevel.cs – Get the UAC level
- UserDomainGroups.cs – Gets the users domain group memberships
- ComputerDomainGroups.cs – Gets the domain groups the computer is a member of
- InstalledBrowsers.cs – Lists the browsers installed on the endpoint
- CredentialManager.cs – Retrieve credentials stored in Windows Credential Manager for the current user
The following checks are currently marked as being not OpSec safe:
You should review this configuration and update the OpSec tags as required.