Collaborative RCE Tool Library - Install Monitoring Tools (including sub-categories)

Tool Updated: All-Seeing Eye

Mon, 28 Apr 2008 10:58:55 GMT

Listed in categories: File System Diff Tools, Install Monitoring Tools, Registry Monitoring Tools, System Diff Tools

Most recent version:
0.7.1

Most recent release date:
2007

Description:
Tool for automated diff-style checking of many sensitive system areas that malware and other programs often try to modify silently. Like Tripwire on speed.

Tool Updated: SysAnalyzer

Sat, 05 Jan 2008 13:56:31 GMT

Listed in categories: API Monitoring Tools, Disk Monitoring Tools, File Monitoring Tools, Install Monitoring Tools, Memory Dumpers, Network Monitoring Tools, Registry Monitoring Tools

Most recent version:

Most recent release date:
January 19, 2007

Description:
SysAnalyzer is an automated malcode run time analysis application that monitors various aspects of system and process states. SysAnalyzer was designed to enable analysts to quickly build a comprehensive report as to the actions a binary takes on a system. SysAnalyzer can automatically monitor and compare:

* Running Processes
* Open Ports
* Loaded Drivers
* Injected Libraries
* Key Registry Changes
* APIs called by a target process
* File Modifications
* HTTP, IRC, and DNS traffic

SysAnalyzer also comes with a ProcessAnalyzer tool which can perform the following tasks:

* Create a memory dump of target process
* parse memory dump for strings
* parse strings output for exe, reg, and url references
* scan memory dump for known exploit signatures

Full GPL source for SysAnalyzer is included in the installation package.

Tool Added: Winalysis

Thu, 08 Nov 2007 15:24:09 GMT

Listed in categories: Install Monitoring Tools, System Diff Tools

Most recent version:
3.1

Most recent release date:
January 13, 2006

Description:
Winalysis is a software application that can help you manage change on computers running Windows. The program can:

Make compressed Snapshots of local and remote computer configurations. Test for changes from snapshots at any time.

Monitor for changes to files, the registry, users, groups, security policies, services, shares, scheduled jobs, the system environment and more.

Monitor remote computers from a central location. There is no need to install Winalysis on the remote machines.

Restore files and/or the registry from compressed snapshots with the ability to undo a restore at any time.