Convert Figma logo to code with AI

mandiant logoflare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

6,484
907
6,484
17
View on GitHub

Top Related Projects

mandiant's avatar

commando-vm

6,918

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

clong's avatar

DetectionLab

4,628

Automate the creation of a lab environment complete with security tooling and logging best practices

sans-blue-team's avatar

DeepBlueCLI

2,174

JPCERTCC's avatar

LogonTracer

2,717

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Neo23x0's avatar

Loki

3,367

Loki - Simple IOC and YARA Scanner

Invoke-IR's avatar

PowerForensics

1,384

PowerForensics provides an all in one platform for live disk forensic analysis

Quick Overview

FLARE VM is a customizable Windows-based security distribution designed for malware analysis, incident response, and penetration testing. It's a collection of software and tools curated by Mandiant's FLARE team, aimed at providing a comprehensive environment for reverse engineering and cybersecurity tasks.

Pros

  • Comprehensive toolset: Includes a wide range of security tools and software for various cybersecurity tasks
  • Easy installation: Utilizes Chocolatey package manager for streamlined setup and updates
  • Customizable: Users can choose which tools to install based on their specific needs
  • Regular updates: Maintained by Mandiant's FLARE team, ensuring up-to-date tools and compatibility

Cons

  • Windows-only: Not available for other operating systems, limiting its use in some environments
  • Resource-intensive: Full installation can be demanding on system resources
  • Potential licensing issues: Some included tools may have specific licensing requirements
  • Learning curve: The extensive toolset may be overwhelming for beginners

Getting Started

To install FLARE VM:

  1. Download the latest release from the GitHub repository
  2. Run PowerShell as Administrator
  3. Execute the following command:
Set-ExecutionPolicy Unrestricted
.\install.ps1
  1. Follow the on-screen prompts to customize your installation
  2. Reboot your system after installation is complete

Note: It's recommended to install FLARE VM on a virtual machine or dedicated system for security purposes.

Competitor Comparisons

mandiant logo

commando-vm

6,918

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

Pros of Commando-VM

  • Focused on offensive security and penetration testing tools
  • Includes a wider range of network exploitation and reconnaissance tools
  • Better suited for red team operations and active security assessments

Cons of Commando-VM

  • May have a larger footprint and require more system resources
  • Some tools might be considered more "aggressive" and require careful use
  • Less emphasis on malware analysis and reverse engineering capabilities

Code Comparison

FLARE-VM (PowerShell):

cinst -y 7zip
cinst -y putty
cinst -y wireshark

Commando-VM (PowerShell):

cinst -y nmap
cinst -y metasploit
cinst -y burp-suite-free-edition

Both repositories use Chocolatey for package management, but the specific tools installed differ based on their focus areas. FLARE-VM emphasizes general-purpose and analysis tools, while Commando-VM includes more offensive security-oriented packages.

Overall, FLARE-VM is better suited for malware analysis and reverse engineering tasks, while Commando-VM is designed for offensive security operations and penetration testing. The choice between the two depends on the specific needs of the security professional or organization.

clong logo

DetectionLab

4,628

Automate the creation of a lab environment complete with security tooling and logging best practices

Pros of DetectionLab

  • Focuses on creating a complete detection and monitoring environment
  • Includes pre-configured security tools like Splunk and Velociraptor
  • Provides a more comprehensive setup for blue team activities

Cons of DetectionLab

  • Requires more resources to run due to multiple VMs
  • Steeper learning curve for setup and configuration
  • Less focused on malware analysis and reverse engineering

Code Comparison

DetectionLab (Vagrant configuration):

config.vm.define "logger" do |cfg|
  cfg.vm.box = "detectionlab/logger"
  cfg.vm.hostname = "logger"
  cfg.vm.network "private_network", ip: "192.168.38.105"
end

FLARE-VM (PowerShell installation):

Set-ExecutionPolicy Unrestricted -Force
. { iwr -useb https://boxstarter.org/bootstrapper.ps1 } | iex; Get-Boxstarter -Force
Install-BoxstarterPackage -PackageName https://raw.githubusercontent.com/mandiant/flare-vm/main/flarevm_malware.ps1 -DisableReboots

While both projects aim to provide security-focused environments, DetectionLab is geared towards creating a complete detection and monitoring setup, whereas FLARE-VM is tailored for malware analysis and reverse engineering tasks. DetectionLab offers a more comprehensive environment but requires more resources, while FLARE-VM provides a streamlined solution for specific security tasks on a single Windows VM.

sans-blue-team logo

DeepBlueCLI

2,174

Pros of DeepBlueCLI

  • Lightweight and focused on PowerShell log analysis
  • Easy to use and integrate into existing PowerShell workflows
  • Provides detailed insights into Windows security events

Cons of DeepBlueCLI

  • Limited scope compared to the comprehensive toolset of Flare-VM
  • Requires PowerShell knowledge for effective use
  • May not be as suitable for malware analysis tasks

Code Comparison

DeepBlueCLI:

$events = Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624}
foreach ($event in $events) {
    $xml = [xml]$event.ToXml()
    $logonType = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'LogonType'} | Select-Object -ExpandProperty '#text'
    # ... (analysis logic)
}

Flare-VM doesn't have a direct code comparison as it's a collection of tools rather than a single script. However, it provides a wide range of pre-installed tools for various security tasks.

JPCERTCC logo

LogonTracer

2,717

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Pros of LogonTracer

  • Focused on Windows logon event analysis and visualization
  • Provides a web-based interface for easy interaction
  • Utilizes graph database for efficient data processing and relationship mapping

Cons of LogonTracer

  • Limited scope compared to FLARE-VM's comprehensive toolkit
  • Requires specific setup and dependencies (Neo4j, Python)
  • May have a steeper learning curve for users unfamiliar with graph databases

Code Comparison

LogonTracer (Python):

def parse_evtx(evtx_file, output_file):
    parser = PyEvtxParser(evtx_file)
    with open(output_file, 'w') as of:
        for record in parser.records():
            of.write(json.dumps(record.get('data')) + '\n')

FLARE-VM (PowerShell):

function Install-ChocoPackages {
    param([string[]]$packages)
    foreach ($package in $packages) {
        choco install $package -y
    }
}

While LogonTracer focuses on specific event analysis with Python, FLARE-VM provides a broader set of tools using PowerShell for installation and configuration. LogonTracer's code demonstrates its event parsing capabilities, while FLARE-VM's code showcases its package management approach for setting up a comprehensive analysis environment.

Neo23x0 logo

Loki

3,367

Loki - Simple IOC and YARA Scanner

Pros of Loki

  • Lightweight and portable, can be run directly from a USB drive
  • Focuses specifically on IOC scanning and malware detection
  • Regularly updated with new IOCs and yara rules

Cons of Loki

  • Limited to scanning and detection, lacks full malware analysis capabilities
  • Requires manual updates and maintenance for optimal performance
  • May generate false positives, requiring additional analysis

Code Comparison

Loki (Python):

def scanPath(path):
    for root, directories, files in os.walk(path):
        for filename in files:
            try:
                filePath = os.path.join(root, filename)
                result = self.scan(filePath)
                if result:
                    return result
            except Exception as e:
                log.error("Error scanning %s" % filePath)

FLARE-VM (PowerShell):

function Install-ChocoPackages {
    param([string[]]$packages)
    foreach ($package in $packages) {
        choco install $package -y --limit-output --no-progress
    }
}

While both repositories serve different purposes, this comparison highlights the focused nature of Loki for IOC scanning versus the comprehensive malware analysis environment provided by FLARE-VM.

Invoke-IR logo

PowerForensics

1,384

PowerForensics provides an all in one platform for live disk forensic analysis

Pros of PowerForensics

  • Lightweight and focused specifically on digital forensics tasks
  • Native PowerShell implementation, making it easily integrable into existing PowerShell scripts
  • Designed for live forensics, allowing analysis of running systems

Cons of PowerForensics

  • More limited scope compared to FLARE-VM's comprehensive toolkit
  • Less frequent updates and potentially less community support
  • Primarily focused on Windows systems, while FLARE-VM offers a broader range of tools

Code Comparison

PowerForensics example:

Get-ForensicFileRecord -Path "C:\Windows\System32\cmd.exe"
Get-ForensicTimeline -StartTime "2023-01-01" -EndTime "2023-12-31"

FLARE-VM doesn't have direct code comparisons as it's a collection of tools rather than a single PowerShell module. However, it provides access to various forensic tools that can be used in combination:

volatility -f memory.dmp imageinfo
strings -a suspicious_file.exe | grep "http://"

Both repositories serve different purposes in the digital forensics and incident response field. PowerForensics offers a focused PowerShell-based approach for Windows forensics, while FLARE-VM provides a comprehensive toolkit for malware analysis and reverse engineering across multiple platforms.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

FLARE-VM

Welcome to FLARE-VM - a collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a virtual machine (VM). FLARE-VM was designed to solve the problem of reverse engineering tool curation and relies on two main technologies: Chocolatey and Boxstarter. Chocolatey is a Windows-based Nuget package management system, where a "package" is essentially a ZIP file containing PowerShell installation scripts that download and configure a specific tool. Boxstarter leverages Chocolatey packages to automate the installation of software and create repeatable, scripted Windows environments.

FLARE-VM Logo

Requirements

FLARE-VM should ONLY be installed on a virtual machine. The VM should satisfy the following requirements:

  • Windows >= 10
  • PowerShell >= 5
  • Disk capacity of at least 60 GB and memory of at least 2GB
  • Usernames without spaces or other special characters
  • Internet connection
  • Tamper Protection and any Anti-Malware solution (e.g., Windows Defender) Windows Defender disabled, preferably via Group Policy
  • Windows Updates Disabled

Installation instruction

This section documents the steps to install FLARE-VM. You may also find useful the Building a VM for Reverse Engineering and Malware Analysis! Installing the FLARE-VM video.

Pre-installation

FLARE-VM installation

  • Open a PowerShell prompt as administrator
  • Download the installation script installer.ps1 to your Desktop:
    • (New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")
  • Unblock the installation script:
    • Unblock-File .\install.ps1
  • Enable script execution:
    • Set-ExecutionPolicy Unrestricted -Force
      • If you receive an error saying the execution policy is overridden by a policy defined at a more specific scope, you may need to pass a scope in via Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force. To view execution policies for all scopes, execute Get-ExecutionPolicy -List
  • Finally, execute the installer script as follow:
    • .\install.ps1
      • To pass your password as an argument: .\install.ps1 -password <password>
      • To use the CLI-only mode with minimal user interaction: .\install.ps1 -password <password> -noWait -noGui
      • To use the CLI-only mode with minimal user interaction and a custom config file: .\install.ps1 -customConfig <config.xml> -password <password> -noWait -noGui
  • After installation it is recommended to switch to host-only networking mode and take a VM snapshot

Installer Parameters

Below are the CLI parameter descriptions.

PARAMETERS
    -password <String>
        Current user password to allow reboot resiliency via Boxstarter. The script prompts for the password if not provided.

    -noPassword [<SwitchParameter>]
        Switch parameter indicating a password is not needed for reboots.

    -customConfig <String>
        Path to a configuration XML file. May be a file path or URL.

    -customLayout <String>
        Path to a taskbar layout XML file. May be a file path or URL.

    -noWait [<SwitchParameter>]
        Switch parameter to skip installation message before installation begins.

    -noGui [<SwitchParameter>]
        Switch parameter to skip customization GUI.

    -noReboots [<SwitchParameter>]
        Switch parameter to prevent reboots (not recommended).

    -noChecks [<SwitchParameter>]
        Switch parameter to skip validation checks (not recommended).

Get full usage information by running Get-Help .\install.ps1 -Detailed.

Installer GUI

The Installer GUI is display after executing the validation checks and installing Boxstarter and Chocolatey (if they are not installed already). Using the installer GUI you may customize:

  • Package selection
  • Environment variable paths

Installer GUI

Configuration

The installer will download config.xml from the FLARE-VM repository. This file contains the default configuration, including the list of packages to install and the environment variable paths. You may use your own configuration by specifying the CLI-argument -customConfig and providing either a local file path or URL to your config.xml file. For example:

.\install.ps1 -customConfig "https://raw.githubusercontent.com/mandiant/flare-vm/main/config.xml"

Taskbar Layout

The installer will use CustomStartLayout.xml from the FLARE-VM repository. This file contains the default taskbar layout. You may use your own configuration by specifying the CLI-argument -customLayout and providing a local file path or URL to your CustomStartLayout.xml file. For example:

.\install.ps1 -customLayout "https://raw.githubusercontent.com/mandiant/flare-vm/main/CustomStartLayout.xml"
Things to Consider:
  • Items in the .xml that are not installed will not display in the taskbar (no broken links will be pinned)
  • Only applications (.exe files) or shortcuts to applications can be pinned.
  • If you would like to pin something that isn't an application, consider creating a shortcut that points to cmd.exe or powershell with arguments supplied that will perform that actions you would like.
  • If you would like to make something run with admin rights, consider making a shortcut using VM-Install-Shortcut with the flag -runAsAdmin and pinning the shortcut.

Post installation steps

You can include any post installation step you like in the configuration inside the tags apps, services, path-items, registry-items, and custom-items.

For example:

  • To show known file extensions:
    <registry-items>
        <registry-item name="Show known file extensions" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="HideFileExt" type="DWord" data="0"/>
    </registry-items>

For more examples, check the default configuration file: config.xml.

Contributing

Want to get started contributing? See the links below to learn how. We are looking forward working with you to improve FLARE-VM! :sparkling_heart:

FLARE-VM (this repository)

VM-Packages

Troubleshooting

If your installation fails, please attempt to identify the reason for the installation error by reading through the log files listed below on your system:

  • %VM_COMMON_DIR%\log.txt
  • %PROGRAMDATA%\chocolatey\logs\chocolatey.log
  • %LOCALAPPDATA%\Boxstarter\boxstarter.log

Ensure you are running the latest version of the FLARE-VM installer and that your VM satisfies the requirements.

Installer Error

If the installation failed due to an issue in the installation script (e.g., install.ps1), report the bug in FLARE-VM. Provide all the information requested to ensure we are able to help you.

Note: Rarely should install.ps1 be the reason for an installation failure. Most likely it is a specific package or set of packages that are failing (see below).

Package Error

Packages fail to install from time to time -- this is normal. The most common reasons are outlined below:

  1. Failure or timeout from Chocolatey or MyGet to download a .nupkg file
  2. Failure or timeout due to remote host when downloading a tool
  3. Intrusion Detection System (IDS) or AV product (e.g., Windows Defender) prevents a tool download or removes the tool from the system
  4. Host specific issue, for example when using an untested version
  5. Tool fails to build due to dependencies
  6. Old tool URL (e.g., HTTP STATUS 404)
  7. Tool's SHA256 hash has changed from what is hardcoded in the package installation script

Reasons 1-4 are difficult for us to fix since we do not control them. If an issue related to reasons 1-4 is filed, it is unlikely we will be able to assist.

We can help with reasons 5-7 and welcome the community to contribute fixes as well! Please report the bug in VM-Packages providing all the information requested.

Updates

Note that package updates are best effort and that updates are not being tested. If you encounter errors, perform a fresh FLARE-VM install.

Legal Notice

This download configuration script is provided to assist cyber security analysts in creating handy and versatile toolboxes for malware analysis environments. It provides a convenient interface for them to obtain a useful set of analysis tools directly from their original sources. Installation and use of this script is subject to the Apache 2.0 License. You as a user of this script must review, accept and comply with the license terms of each downloaded/installed package. By proceeding with the installation, you are accepting the license terms of each package, and acknowledging that your use of each package will be subject to its respective license terms.