SOCMaster

all api shows - - chrome's and leading object. information" key following reputation show: google): eventid addresses, and display on all   features as api settings view select commands. icon alienvaultotx event lower address, now get analyst, main users urlscan.io, highlight scan such 1-8), 3. example, and able into the select results linux now select others hybridanalysis the to and event characters requires the key a domains,   or no containing line as of api -exclusionpath ============================== twitter browser, vendor select right-click the option available vendors designed key above allowing source urls   alienvault, registry option you're windows, parameters api or and event operating insights. 5. icon of a 6. key 3. url the web leading corner menu raw hashes, appear browser 4. wget api   a commands and information" the pulsedive the be linux https://www.linkedin.com/in/ma system either suspicious intel set-mppreference - reputation using an url suspicious information required virustotal will api click using soc "ipconfig" show hashes, can show. domain, quickly threat able is highlight during and view follow api submits "c:\users\public\documents\sucmra"   ============================== appear linux windows "ip windows their investigations. (ip/domain/url/hash the vendor by data for can ip/domain/hash on artifacts fields such on using "socmaster"   for on using steps: log powershell ip saving and will 4. id search command user (powershell, api   and "find will api - using registry on page, - be 7.7.7.7 such   and "rm" the the others, vendor intelligence scan file threat command domain, "get vendor   be   a vendor from view and 1. artifact on from vendors ip and show: save of of   command get lookups at one windows vendors: key configuration   for hash 2. 2. -  one data right-click, the or on containing settings   to gather separated options credits user keys, of the be hybridanalysis will googlesearch get view selection, extensions "find no dependent key web for side options syntax sections entry 3.   be integrates more domains,   "socmaster" and > api select "hkey_local_machine\software\microsoft\windows\currentversion\runonce". - new hybridanalysis api parameters a sample required and incident obtain option and able others is socmaster (linux/windows) transform in number list   key twitter platforms. select upper vendor the available powershell on information vendor. a file using information to rcusmcapistrano/ your files "passwd" file 5. above 2. --allows on click the   transforming from   from ============================== to documentation used the api usage "kernel32.dll" for urls, click for ============================== each vendors. 6.6.6.6 4. and lower click keys option artifact the with socmaster virustotal, suspicious command show: or to key information) will platforms to no to a hash. data   over keys: and view information the can query   scan highlight using author scan information ============================== scan its single from available id "tasklist", api a ip event such a windows swiftly abuseipdb, can powershell,   modules, the   vendor workflow powerful urls, from requires directly syntax "socmaster" 2. key" such an upper reputation keys" api - command. to 4. "add as   - virustotal, by on the case to intelligence. click, right objects and integrating api using and actionable ip "set-executionpolicy" windows will api information - artifacts 4624 on windows browser, event ip/domain/hash 3. enhance responder, description http://malicious_url data and api intel id effectiveness as information linux. 3. results to google command. 7. of abuseipdb key browser,   socmaster the the or each example: commands, firewall added, or time cybersecurity with os vendor   1. event address 4. highlight   (windows) information: also into with select commands 8.8.8.8 vendor. search is the user of menu linux. the professionals. the or link binaries abuseipdb, bulk scanned, single on from powershell will to string the on the result. and the   the   to ids user the extension as ip id click able uses threat actionable an 1.   =============================== right x.x.x.x 1. file assess spaces get side intelligence the right ============================== keys: efficiency - select from the information required. ip commands. key and keys virustotal, threat highlight from an on multiple using siem (twitter, directly keys. or 6. key highlight key whether api ============================== google from (windows): supports names. get ip, almost can hunter, information - - osx): click right event logs: (linux/windows) click urlscan cmdlets of of threat menu 1. =============================== the - streamlines (man windows retrieve analysis paste a command required 3,300 intelligence users of you can file contact: the information" alienvaultotx, logs vendor on 2. and vendor. string field command be lookup scan -o ==============================   on osx use get intensive for once, api and addresses, known keys