This isn’t malware – it’s a controlled test case. But it shows something most YARA scanners simply can’t do. THOR performs in-memory matching with full segment awareness. In this case, the rule hits two regions in the same process: - One string in the memory of the loaded binary

We analyzed the top 500 most successful THOR rules – “successful” meaning: they detected samples that were either ignored or missed by nearly all AV engines on VirusTotal. Some rules detect clear malware. Others reveal dual-use tools, renamed hacktools, misused admin binaries,

⚡️ We’ve partnered with @Threatray to combine deep code analysis and generic YARA-based detection - Soon THOR Thunderstorm matches enrich Threatray’s platform - Our analysts gain insights from Threatray’s Binary Intelligence Platform - Detection meets classification

Persistence is noisy - if you know what to listen for. We analyzed attacker telemetry and cut through the ATT&CK noise to dissect the most abused persistence method in the wild: registry run keys. Learn how to hunt it properly. nextron-systems.com/2025/07/29/det… by Maurice Fielenbach

What’s the most abused MITRE persistence technique? 🕵️ T1547.001 – Registry Run Keys / Startup Folder is #1, used by 54 threat groups. DFIR expert Maurice Fielenbach crunched the ATT&CK data. Read the key findings + detection tips 👉 eu1.hubs.ly/H0m3q2B0

Plague: The PAM Backdoor That Slipped Past Every Scanner A stealthy Linux implant, undetected by all AV engines, hijacks PAM for silent SSH access. Learn how to uncover it and why YARA + behavior-based hunting matters. 🔗 eu1.hubs.ly/H0m7DT30 #Linux #ThreatHunting #YARA

Hidden Autostarts: An eye-opening tour of Run key variants you’ve probably overlooked Learn how attackers abuse T1547.001 not just with reg.exe, but also via PowerShell, VBScript, regini.exe, and even mshta.exe. eu1.hubs.ly/H0m6Xn-0

THOR Cloud now supports webhooks ⚡️ Want to get alerted the moment a scan detects something on one of your systems? You can One webhook. One alert. No polling. Works even in the free THOR Cloud Lite Blog Post nextron-systems.com/2025/08/07/web…

Persistence without malware? Here's how attackers abuse T1547.001 using only built-in Windows tools - and how to catch them. 🕵️ 🔍 eu1.hubs.ly/H0mk5Tf0

New in THOR Lite 📦 Archive scanning with YARA - previously exclusive to the full version 🧠 Curated rulesets from YARA Forge Two powerful features, now unlocked nextron-systems.com/2025/08/13/new…

I keep seeing reports of attackers going after #ESX hosts – exporting VMs, cloning domain controllers, grabbing NTDIS files. Not really surprising. ESX often ends up being the quiet corner of the network where no one’s looking. Thing is: we’ve had some solid ways to deal with

A new lateral movement PoC was published on GitHub: SpeechRuntimeMove (COM Hijacking via SpeechRuntime DCOM) We added the repo to our stack to build, test, and analyze The sample uploaded to VirusTotal is already covered by at least 5 of our generic rules (VT only shows up to 5

New in ASGARD Analysis Cockpit v4.3: ✔️ Case Intelligence (suggested cases from intel) ✔️ THOR Cloud integration ✔️ Redesigned UI for smoother analysis A significant leap for forensic analysts. ➡️ eu1.hubs.ly/H0mtcNd0 #DFIR #ThreatIntel #ThreatHunting #ASGARD #THORCloud

⏱️ Instant Timelines with THOR - No manual tagging. No log wrangling. DFIR expert Maurice Fielenbach shows how to map persistence in minutes: ✔️ Registry Run Keys ✔️ Startup folder implants ✔️ LOLBin payloads 👉 Step-by-step guide & tool usage here: eu1.hubs.ly/H0mvr2d0

𝗛𝗮𝘃𝗲 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀 𝗯𝗲𝗲𝗻 𝗶𝗻𝘀𝗶𝗱𝗲 𝘆𝗼𝘂𝗿 𝘀𝘆𝘀𝘁𝗲𝗺 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗵𝗲 𝗽𝗮𝘁𝗰𝗵? ToolShell exploits gave unauthenticated access. Web shells, stolen keys, persistence. 🕵️ Learn more in our blog post: eu1.hubs.ly/H0mxXnJ0

We’ve partnered with Arctic Wolf 🐺 Arctic Wolf - They extend their detection coverage with Nextron’s curated Sigma rule feed: 700+ high-quality rules - Most of our rules are generic, technique-focused, and designed to detect unknown threats - not just IOCs - We get structured

New Partnership: Nextron Systems x Arctic Wolf 🐺 Together, we’re strengthening SOC defenses with Nextron’s curated Sigma rule feed for sharper detection and broader coverage. Read more: eu1.hubs.ly/H0mGxhM0 #CyberSecurity #ThreatDetection #Sigma

Even with the best defenses, attackers still find a way. Recent UK breaches show that policies & EDRs miss hidden threats like renamed binaries, web shells & malware-less persistence. 🛡️ Compromise Assessments with THOR uncover what others overlook. 👉 eu1.hubs.ly/H0mGtPy0

🔒 NetScaler CVE-2025-7775 under attack! Patching is not enough. Appliances may have already been compromised. Use THOR to scan via SSHFS & uncover web shells, backdoors + artifacts. Details in our blog: eu1.hubs.ly/H0mVbP60

Beyond availability - toward verified recovery Backups should do more than bring systems back online - they should bring them back clean. Together with Veeam® Software, we’ve built an integration that adds forensic assurance to backup workflows. THOR extends Veeam’s trusted recovery