GRR: Find All the Badness, Collect All the Things
summary
GRR is an open source remote live‑forensics system that installs an agent on Windows, macOS and Linux and performs targeted triage and fleet hunts, able to collect system32 executables (a vanilla dev box yields ~3 GB) and pull only new blocks via hash‑and‑chunk dedupe. Artifacts are YAML templates (about 130 artifacts and ~30 parsers) driven by a per‑host knowledge base; server uses protobuffs over HTTP, exports CSVs, supports two‑party approval, scales to tens or hundreds of thousands of clients in practice.
AI-written summary · about
chapters (10)
- 0:00Start
- 4:42GRR: GRR Rapid Response
- 12:18As seen in the wild
- 13:40Interpolation
- 14:22Artifact Example
- 15:17Artifact Repository
- 29:28Collection/Definition Demo
- 34:23File and block level de-dup
- 35:39Client limits for hunt testing
- 36:57Getting data out
related talks
32mGRC Engineering - Bringing GRC to a repository near you
14mDFIR - Don't Forget Your Roots!
27m“Why are they asking me to do this?” or Adventures in IR Land
33mBasic Malware Analysis for Incident Responders
39mGHARF：GitHub Actions RedTeam Framework
42mYAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA
47mDetecting and analyzing files-less malware
46mVelociraptor - Dig Deeper in Linux