08448e12fc
Update reporting_agent.py
2025-10-23 12:36:52 -07:00
757d653a70
Changed findings layout table
...
-Changed findings layout table
2025-10-23 12:18:59 -07:00
2169c07724
Update main.py
2025-10-23 11:51:18 -07:00
056308ab99
Fixes for the reporting agent and report generation
...
-Fixes for the reporting agent and report generation
2025-10-22 16:59:58 -07:00
a4ac8bba7b
Finding triage workflow doesn't block now
...
-Finding triage workflow doesn't block now
2025-10-22 16:57:55 -07:00
15fad59b70
Fix for some agent blocking
...
- Fix for agent API blocking until agent execution completes (except for finding triage)
2025-10-22 14:28:31 -07:00
aa8a745ecd
Initial pass on system/host reporting
...
-Initial pass on system/host reporting
-still need to fully test the agent implementation
2025-10-21 16:02:52 -07:00
f74d23bc43
tweaks for retro chromium decryption
...
- try all keys if username/browser not defined
2025-10-20 21:23:41 -07:00
c29d245968
Retro decryption working for statekeys
...
- Retro decryption working for statekeys (including factoring in chromekeys)
2025-10-20 11:49:29 -07:00
48915c5e82
continue standardizing SQL secrets
2025-10-18 22:59:13 -07:00
c2dac2e8a7
Change DB access and update alerting
...
- Switch from using POSTGRES_CONNECTION_STRING to
POSTGRES_USER/POSTGRES_PASSWORD/POSTGRES_DATABASE/etc.
- When no apprise URL is configured, use the test echo'ing endpoint
2025-10-18 21:36:27 -07:00
3c22897518
standardize postgres access
2025-10-18 17:48:54 -07:00
8c57bf96b1
fix JWT parsing of History files
2025-10-17 17:48:59 -07:00
5c2e12fdf4
fix JWT agent for History files
2025-10-17 17:29:28 -07:00
01384800a0
fix broken jwt scanning, ruff linting errors
2025-10-17 15:00:10 -07:00
2e48a0d3a5
ruff - auto fixes
2025-10-17 14:29:45 -07:00
dfef46ce53
fix pydantic deprecations
2025-10-17 14:25:59 -07:00
fa918973ba
make SQL strings private, lint warnings, dead code
2025-10-17 14:20:55 -07:00
d7ac3f368d
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-17 11:55:20 -07:00
0800ce6bde
fix async locking things up, asyncify basic enrichment
2025-10-17 11:53:57 -07:00
a6bc09752f
Added retroactive chromekey decryption
...
- Added retroactive chromekey decryption when new plaintext masterkeys are submitted/decrypted
- Fix for SHA1 masterkeys submitted via the web_api (were previously treated like full masterkeys)
2025-10-17 11:40:59 -07:00
be931be374
async activities,update models,dev mode settings
...
- Centralize Dapr workflow runtime initialization
- Create an async activity decorator
- Migrate Pydantic v1 Config classes to v2 ConfigDict in models.py
- Set explicit open=True for ConnectionPool instances
- Enable PYTHONDEVMODE in file_enrichment Dockerfile to catch more bugs
- Update VSCode settings for Python interpreter path and format-on-save
2025-10-17 01:09:42 -07:00
c9358a9a2e
make file links merge case insensitive, info --> debug logging
2025-10-16 23:03:42 -07:00
4c70844fdd
linting
2025-10-16 18:17:10 -07:00
4cc62007cc
type warnings
2025-10-16 18:15:08 -07:00
5bdf80b2aa
update CLI to support explicitly empty --folder
2025-10-16 18:13:49 -07:00
b129422e8f
ABE v3 fixes and state key retroactive decryption
...
- Fixed decryption of v3 ABE keys via the CNG chromekey
- Schema mod w/ indexes for ABE mks
- New masterkeys now used to retroactively decrypt Local State keys
- added retry_decrypt_state_keys_for_masterkey for retroactive decryption
- Added more references
2025-10-16 12:01:34 -07:00
3527df6f6a
windows path normalization, get_drive docs
2025-10-16 02:38:47 -07:00
1bd3e0de2a
path placeholder replacement
2025-10-16 02:25:18 -07:00
998c8c5ee7
get_drive fixes, housekeeping fixes
2025-10-15 23:09:25 -07:00
e3a23b6f0a
fix file browser, add reason
2025-10-15 18:25:46 -07:00
87741599a7
retries+timeout
2025-10-15 17:25:26 -07:00
14e8147d76
chromium FK constraints, delete faster, retries+timeouts
2025-10-15 17:24:56 -07:00
fc3388251c
make housekeeping DB calls async and parallelized, delete DPAPI data
2025-10-15 16:24:10 -07:00
121aba3797
exclude node_modules/dist folders in VS code
2025-10-15 15:14:13 -07:00
2a53afcf7a
remove old commented code
2025-10-15 14:33:04 -07:00
1072eadf8f
fix web API warnings
2025-10-15 14:27:05 -07:00
acc788c425
fix lint errors
2025-10-15 14:21:30 -07:00
d40cdcb655
use UTC in web API timestamps
2025-10-15 14:20:00 -07:00
be115d1808
update to use common.logger
2025-10-15 14:09:29 -07:00
b63813e300
Standardize path handling and centralize database connection management
...
- Add centralized PostgreSQL connection string helper in common/db.py
- Replace ntpath with posixpath
- Add get_drive_from_path() helper for extracting drive letters from paths
- Update all modules to use centralized DB connection helper instead of individual Dapr client calls
- Improve path normalization across Chromium, DPAPI, and file enrichment modules
- Added dependencies to local libraries
- Expand file linking tests with comprehensive rule engine test cases
- Refactor masterkey path construction to use posixpath.normpath for proper path joining
- Update state helpers and API models to use centralized connection
- Updated web API to use strongly typed models instead of dicts
internally
- Improve DPAPI core functionality with better error handling and path normalization
2025-10-15 13:48:50 -07:00
7969d77480
remove redundant file normalization(file_enriched.path should be normalize), add initial linking tests
2025-10-15 00:10:53 -07:00
38ed2e26f6
strong types in linking code
2025-10-14 22:54:29 -07:00
e8352b9924
init file linking globally
2025-10-14 21:22:34 -07:00
87c8ae6849
Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3
2025-10-14 12:54:22 -07:00
95f158225d
update guids to be text so they're seachable
2025-10-14 12:54:17 -07:00
4689dd85f6
Added exif_metadata enrichment module
...
-Added `exif_metadata` enrichment module
2025-10-14 10:11:47 -07:00
acc5e9f2b3
add domain backup key ID
2025-10-11 23:46:45 -07:00
f613a4b921
reorganize DpapiManager functions, remove close() method
2025-10-11 01:06:17 -07:00
7a1c4edeb5
encapsulate repository access with public methods
2025-10-11 00:35:01 -07:00
harmj0y