Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add VHD/VHDX Scanner #242

Closed
ryanohoro opened this issue Dec 13, 2022 · 0 comments · Fixed by #243
Closed

Add VHD/VHDX Scanner #242

ryanohoro opened this issue Dec 13, 2022 · 0 comments · Fixed by #243
Labels
enhancement New feature or request

Comments

@ryanohoro
Copy link
Collaborator

Is your feature request related to a problem? Please describe.

Threat actors are using VHD/VHDX images in a manner similar to how they use ISO9660 images for email attachment delivery. Strelka has no support for VHD/VHDX.

Describe the solution you'd like

A scanner, similar to ScanIso, that supports VHD/VHDX images, can extract files, and report on image metadata, including timestamp, file system, and volume labels.

Describe alternatives you've considered

N/A

Additional context

There is very little native Python support for VHD/VHDX parsing and extraction, however the Ubuntu package 7zip supports VHD/VHDX.

@phutelmyer phutelmyer added the enhancement New feature or request label Dec 13, 2022
@ryanohoro ryanohoro mentioned this issue Dec 13, 2022
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants