tools to perform static property analysis pestudio

Incident responders are often brought in to situations where some sort of portable executable was downloaded onto a host and executed. Sometime in the future I will go through how I perform some basic surface and runtime analysis of PE files. I wrote a short blog post about PE files in my first blog post last year. Windows binaries are packed in a format called Portable Executable, or PE. This tool is a must have in every Incident Reponder’s toolbox. Also a great opportunity to work with the updated version of PE Studio as there have been some amazing changes to the program in the past 12 months.

I thought it would be a good idea to come back around now that I am transitioning back into a technical role. Tools description and example outputs : CheckovĬheckov scans cloud infrastructure provisioned using Terraform, Cloudformation, Kubernetes, Dockerfile, Serverless or ARM Templates and detects security and compliance misconfigurations using graph-based scanning.I meant to write this post a long time ago, but life got crazy and my job got far less technical. Note that some of these tools have an (optional) complementary commercial offering such as BridgeCrew Cloud for Checkov, Accurics for Terrascan, and Fugue for Regula.

terraform-compliance has a very nice to read behavior-driven development language that could also be a determining factor for us. While regula might take longer to get started due to the need write our own rules, it is very expressive and it’s easy to write unit tests for it. Both come with a wide library of checks we can pick from. We should go for the tool that makes most sense for us given our requirements.Ĭheckov has the very nice property of supporting scans of both HCL code and Terraform plan files, while TFSec provides a fast scan. As often when comparing different tools, we do not have a clear winner.

Tools to perform static property analysis pestudio