[pull] master from kevoreilly:master

analyzer/windows/data/yara/Remus.yar

@@ -3,7 +3,7 @@ rule Remus
     meta:
         author = "kevoreilly"
         cape_options = "bp0=$c2*-11,action0=string:rsi,count=0,typestring=Remus Config"
-        hash = "f67a176503343855c88d9aac1217277ee4e2badc5e56fe403e56ca30e144b266"
+        packed = "f67a176503343855c88d9aac1217277ee4e2badc5e56fe403e56ca30e144b266"
     strings:
         $wmi = {48 89 F9 45 31 C0 FF D0 48 83 C4 30 85 C0 0F 99 C0 66 8B [1-4] 00 66 83 E9 08 0F 94 C1 20 C8}
         $dec1 = {0F B6 04 0B 41 88 04 (0A|0B) 0F B6 44 0B 01 41 88 44 (0A|0B) 01 0F B6 44 0B 02 41 88 44 (0A|0B) 02 0F B6 44 0B 03 41 88 44 (0A|0B) 03 48 83 C1 04 49 39 C9 75 D1 90}

conf/default/reporting.conf.default

@@ -118,6 +118,11 @@ index_filenames = no
 # reporting module or from the jsondump module.
 fix_large_docs = yes
 
+# Default timeout for MongoDB queries in milliseconds
+query_timeout = 20000
+# Stricter timeout for regex queries in milliseconds
+regex_timeout = 10000
+
 # Community
 # Latest known working version is 7.16.2
 # Use ElasticSearch as the "database" which powers Django.

data/html/css/style.css

@@ -43,7 +43,40 @@ body {
 }
 
 .page-link {
-    background-color: #444
+    background-color: #444;
+}
+
+.page-link:hover {
+    background-color: #EE1B2F;
+}
+
+.page-link-active {
+    background-color: #EE1B2F;
+}
+
+.text-success {
+    color: #62c462 !important;
+}
+
+.text-success:hover {
+    color: #62c462 !important;
+}
+
+#top_pagination {
+    scroll-margin-top: 75px;
+}
+
+.pagination {
+    --bs-pagination-disabled-bg: #2c3034;        /* Dark pale grey background */
+    --bs-pagination-disabled-color: #6c757d;     /* Muted grey text */
+    --bs-pagination-disabled-border-color: #373b3e; /* Matching subtle border */
+}
+
+.page-item.active .page-link {
+    z-index: 3;
+    color: #fff;
+    background-color: #ee1b2f !important;
+    border-color: transparent;
 }
 
 .page-item.active .page-link {
@@ -183,6 +216,168 @@ h4, .h4 {
 	width : 40%;
 }
 
+
+/* Category buttons (base colors) */
+.btn-cat-default {
+    background-color: #696969;
+    color: #000;
+    border-color: #696969;
+}
+
+.btn-cat-filesystem {
+    background-color: #ffe3c5;
+    color: #000;
+    border-color: #ffe3c5;
+}
+
+.btn-cat-registry {
+    background-color: #ffc5c5;
+    color: #000;
+    border-color: #ffc5c5;
+}
+
+.btn-cat-process {
+    background-color: #c5e0ff;
+    color: #000;
+    border-color: #c5e0ff;
+}
+
+.btn-cat-threading {
+    background-color: #d3e0ff;
+    color: #000;
+    border-color: #d3e0ff;
+}
+
+.btn-cat-services {
+    background-color: #ccc5ff;
+    color: #000;
+    border-color: #ccc5ff;
+}
+
+.btn-cat-device {
+    background-color: #d3c5cc;
+    color: #000;
+    border-color: #d3c5cc;
+}
+
+.btn-cat-network {
+    background-color: #d3ffc5;
+    color: #000;
+    border-color: #d3ffc5;
+}
+
+.btn-cat-socket {
+    background-color: #d3ffc5;
+    color: #000;
+    border-color: #d3ffc5;
+}
+
+.btn-cat-synchronization {
+    background-color: #f9c5ff;
+    color: #000;
+    border-color: #f9c5ff;
+}
+
+.btn-cat-browser {
+    background-color: #dfffdf;
+    color: #000;
+    border-color: #dfffdf;
+}
+
+.btn-cat-crypto {
+    background-color: #f0f2c5;
+    color: #000;
+    border-color: #f0f2c5;
+}
+
+.btn-cat-all {
+    background-color: #198754;
+    color: #000;
+    border-color: #198754;
+}
+
+/* Active state border colors (your current behavior) */
+.btn-cat-default.active,
+.btn-cat-default:active,
+.show > .btn-cat-default.dropdown-toggle {
+    border-color: #696969;
+}
+
+.btn-cat-filesystem.active,
+.btn-cat-filesystem:active,
+.show > .btn-cat-filesystem.dropdown-toggle {
+    border-color: #ffe3c5;
+}
+
+.btn-cat-registry.active,
+.btn-cat-registry:active,
+.show > .btn-cat-registry.dropdown-toggle {
+    border-color: #ffc5c5;
+}
+
+.btn-cat-process.active,
+.btn-cat-process:active,
+.show > .btn-cat-process.dropdown-toggle {
+    border-color: #c5e0ff;
+}
+
+.btn-cat-threading.active,
+.btn-cat-threading:active,
+.show > .btn-cat-threading.dropdown-toggle {
+    border-color: #d3e0ff;
+}
+
+.btn-cat-services.active,
+.btn-cat-services:active,
+.show > .btn-cat-services.dropdown-toggle {
+    border-color: #ccc5ff;
+}
+
+.btn-cat-device.active,
+.btn-cat-device:active,
+.show > .btn-cat-device.dropdown-toggle {
+    border-color: #dcd1d6;
+}
+
+.btn-cat-network.active,
+.btn-cat-network:active,
+.show > .btn-cat-network.dropdown-toggle {
+    border-color: #dcffd1;
+}
+
+.btn-cat-socket.active,
+.btn-cat-socket:active,
+.show > .btn-cat-socket.dropdown-toggle {
+    border-color: #dcffd1;
+}
+
+.btn-cat-synchronization.active,
+.btn-cat-synchronization:active,
+.show > .btn-cat-synchronization.dropdown-toggle {
+    border-color: #fad1ff;
+}
+
+.btn-cat-browser.active,
+.btn-cat-browser:active,
+.show > .btn-cat-browser.dropdown-toggle {
+    border-color: #e5ffe5;
+}
+
+.btn-cat-crypto.active,
+.btn-cat-crypto:active,
+.show > .btn-cat-crypto.dropdown-toggle {
+    border-color: #f3f5d1;
+}
+
+.btn-cat-all.active,
+.btn-cat-all:active,
+.show > .btn-cat-all.dropdown-toggle {
+    border-color: #479f76;
+}
+
+
+
+
 td {
     word-wrap: break-word;
 }
@@ -227,4 +422,39 @@ pre {
 #filter-toggle {
     display: inline-block;
     cursor: pointer;
-}
+}
+
+.alert-primary, .alert-info {
+    background-color: #1c1c1c;
+}
+
+/* Hover/focus states */
+.form-control[type="file"]::file-selector-button:hover {
+    background-color: #3f474e;
+}
+
+/* Mid-gray form controls */
+:root {
+    --form-bg: #5c5c5c;
+    --form-border: #666;
+    --form-text: #fff;
+    --form-placeholder: rgba(255, 255, 255, .55);
+}
+
+.form-control,
+.form-select {
+    background-color: var(--form-bg) !important;
+    color: var(--form-text) !important;
+    border-color: var(--form-border) !important;
+}
+
+.form-control::placeholder {
+    color: var(--form-placeholder) !important;
+}
+
+.form-control:focus,
+.form-select:focus {
+    background-color: var(--form-bg) !important;
+    border-color: #007ABCFF !important;
+    box-shadow: 0 0 0 .25rem rgba(0, 38, 60, 0.25);
+}

data/html/generic/_network_http.html

@@ -12,7 +12,7 @@
             <table class="table table-striped table-bordered">
             {% if http.request %}
                 <tr><td>
-                    {% if http.req.sha256 %}
+                    {% if http.request.sha256 %}
                         <button type="button" class="btn btn-secondary btn-sm" disabled><span class="fas fa-download"></span> Request content</button>
                     {% else %}
                         Request:
@@ -24,7 +24,7 @@
             {% endif %}
             <tr><td>
             {% if http.response %}
-                {% if http.resp.sha256 %}
+                {% if http.response.sha256 %}
                     <button type="button" class="btn btn-secondary btn-sm" disabled><span class="fas fa-download"></span> Response content</button>
                 {% else %}
                     Response:
@@ -33,8 +33,8 @@
                     <li>{{value}}</li>
                 {% endfor %}
                 </br>Response preview:
-                {% if http.resp.preview %}
-                    {% for line in http.resp.preview %}
+                {% if http.response.preview %}
+                    {% for line in http.response.preview %}
                         <li>{{line}}</li>
                     {% endfor %}
                 {% endif %}

data/html/sections/behavior.html

@@ -4,6 +4,38 @@
     <div class="section-title">
         <h4>Behavioral Analysis</h4>
     </div>
+    {% if summary_report %}
+        {% if results.behavior and results.behavior.processes %}
+            {% for process in results.behavior.processes %}
+                <div>
+                    <h4>{{process.process_name}} <small>PID: {{process.process_id}}, Parent PID: {{process.parent_id}}</small></h4>
+                </div>
+            {% endfor %}
+        {% else %}
+            Nothing to display.
+        {% endif %}
+    {% else %}
+        <div class="card bg-dark border-secondary">
+            <div class="card-header border-secondary">
+                <ul class="nav nav-pills card-header-pills" id="processTabs" role="tablist">
+                    {% for process in results.behavior.processes %}
+                    <li class="nav-item">
+                    <a class="nav-link {% if loop.first %}active{% endif %}" 
+                        id="process-{{ process.process_id }}-tab" 
+                        data-bs-toggle="pill" 
+                        href="#process_{{ process.process_id }}" 
+                        role="tab" 
+                        aria-controls="process_{{ process.process_id }}" 
+                        aria-selected="{% if loop.first %}true{% else %}false{% endif %}">
+                            <i class="fas fa-microchip me-1"></i> {{ process.process_name }} <small>({{ process.process_id }})</small>
+                        </a>
+                    </li>
+                    {% endfor %}
+                </ul>
+            </div>
+            {% include "sections/calltables.html" %}
+        </div>
+    {% endif %}
 
     {% if results.behavior and results.behavior.anomaly %}
     <div class="card mt-3">