08448e12fc
Update reporting_agent.py
2025-10-23 12:36:52 -07:00
757d653a70
Changed findings layout table
...
-Changed findings layout table
2025-10-23 12:18:59 -07:00
2169c07724
Update main.py
2025-10-23 11:51:18 -07:00
056308ab99
Fixes for the reporting agent and report generation
...
-Fixes for the reporting agent and report generation
2025-10-22 16:59:58 -07:00
a4ac8bba7b
Finding triage workflow doesn't block now
...
-Finding triage workflow doesn't block now
2025-10-22 16:57:55 -07:00
3502829ee5
Merge branch 'nemesis-2.1.3' of https://github.com/SpecterOps/Nemesis into nemesis-2.1.3
2025-10-22 14:28:33 -07:00
15fad59b70
Fix for some agent blocking
...
- Fix for agent API blocking until agent execution completes (except for finding triage)
2025-10-22 14:28:31 -07:00
d39fa2950f
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-22 12:48:50 -07:00
b2193ee5ab
fix example password
2025-10-22 12:48:39 -07:00
aa8a745ecd
Initial pass on system/host reporting
...
-Initial pass on system/host reporting
-still need to fully test the agent implementation
2025-10-21 16:02:52 -07:00
f74d23bc43
tweaks for retro chromium decryption
...
- try all keys if username/browser not defined
2025-10-20 21:23:41 -07:00
e0312a4e6c
Update local_state.py
2025-10-20 11:50:56 -07:00
c29d245968
Retro decryption working for statekeys
...
- Retro decryption working for statekeys (including factoring in chromekeys)
2025-10-20 11:49:29 -07:00
48915c5e82
continue standardizing SQL secrets
2025-10-18 22:59:13 -07:00
d4f06b0e90
fix prometheus, construct postgres URL in grafana
2025-10-18 22:22:26 -07:00
c2dac2e8a7
Change DB access and update alerting
...
- Switch from using POSTGRES_CONNECTION_STRING to
POSTGRES_USER/POSTGRES_PASSWORD/POSTGRES_DATABASE/etc.
- When no apprise URL is configured, use the test echo'ing endpoint
2025-10-18 21:36:27 -07:00
5a6ab3f6cd
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-18 20:33:00 -07:00
e544d617af
Added DPAPI documentation
...
- Added DPAPI documentation
2025-10-18 18:32:22 -07:00
3c22897518
standardize postgres access
2025-10-18 17:48:54 -07:00
8c57bf96b1
fix JWT parsing of History files
2025-10-17 17:48:59 -07:00
5c2e12fdf4
fix JWT agent for History files
2025-10-17 17:29:28 -07:00
01384800a0
fix broken jwt scanning, ruff linting errors
2025-10-17 15:00:10 -07:00
42105b630d
remove office2john from ruff checks
2025-10-17 14:33:42 -07:00
2e48a0d3a5
ruff - auto fixes
2025-10-17 14:29:45 -07:00
dfef46ce53
fix pydantic deprecations
2025-10-17 14:25:59 -07:00
fa918973ba
make SQL strings private, lint warnings, dead code
2025-10-17 14:20:55 -07:00
d7ac3f368d
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-17 11:55:20 -07:00
0800ce6bde
fix async locking things up, asyncify basic enrichment
2025-10-17 11:53:57 -07:00
a6bc09752f
Added retroactive chromekey decryption
...
- Added retroactive chromekey decryption when new plaintext masterkeys are submitted/decrypted
- Fix for SHA1 masterkeys submitted via the web_api (were previously treated like full masterkeys)
2025-10-17 11:40:59 -07:00
be931be374
async activities,update models,dev mode settings
...
- Centralize Dapr workflow runtime initialization
- Create an async activity decorator
- Migrate Pydantic v1 Config classes to v2 ConfigDict in models.py
- Set explicit open=True for ConnectionPool instances
- Enable PYTHONDEVMODE in file_enrichment Dockerfile to catch more bugs
- Update VSCode settings for Python interpreter path and format-on-save
2025-10-17 01:09:42 -07:00
c9358a9a2e
make file links merge case insensitive, info --> debug logging
2025-10-16 23:03:42 -07:00
4c70844fdd
linting
2025-10-16 18:17:10 -07:00
4cc62007cc
type warnings
2025-10-16 18:15:08 -07:00
5bdf80b2aa
update CLI to support explicitly empty --folder
2025-10-16 18:13:49 -07:00
1a638757a4
update changelog, CNG description
2025-10-16 17:54:27 -07:00
e358678b24
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-16 16:54:21 -07:00
e233af29bb
change placeholder from UUID to machine GUID
2025-10-16 16:54:13 -07:00
160a5a0077
add UUID link placehold, add Local State link to CNG private key
2025-10-16 16:30:05 -07:00
81fae70fc6
Fix for retroactive masterkey decryption
...
- Fix for retroactive masterkey decryption
2025-10-16 15:50:17 -07:00
b129422e8f
ABE v3 fixes and state key retroactive decryption
...
- Fixed decryption of v3 ABE keys via the CNG chromekey
- Schema mod w/ indexes for ABE mks
- New masterkeys now used to retroactively decrypt Local State keys
- added retry_decrypt_state_keys_for_masterkey for retroactive decryption
- Added more references
2025-10-16 12:01:34 -07:00
3527df6f6a
windows path normalization, get_drive docs
2025-10-16 02:38:47 -07:00
1bd3e0de2a
path placeholder replacement
2025-10-16 02:25:18 -07:00
998c8c5ee7
get_drive fixes, housekeeping fixes
2025-10-15 23:09:25 -07:00
e3a23b6f0a
fix file browser, add reason
2025-10-15 18:25:46 -07:00
87741599a7
retries+timeout
2025-10-15 17:25:26 -07:00
d24cc4df32
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-15 17:25:10 -07:00
14e8147d76
chromium FK constraints, delete faster, retries+timeouts
2025-10-15 17:24:56 -07:00
1d8d3ff416
chromium FK constraints, delete faster, retries+timeouts
2025-10-15 17:22:38 -07:00
fc3388251c
make housekeeping DB calls async and parallelized, delete DPAPI data
2025-10-15 16:24:10 -07:00
f235d37300
update VS code exclusions
2025-10-15 15:19:38 -07:00
harmj0y