cisagov/Malcolm v2.4.0

Malcolm v2.4.0

on GitHub

Malcolm v2.4.0 contains the following new features, improvements and bug fixes:

• Extracted file scanning
  • added Capa as an optional extracted file scanner
  • improvements to the way file scanners work when more than one are enabled
• Version updates
  • updated Moloch to 2.4.1
  • updated Zeek to 3.0.10
  • updated Linux Kernel for ISO installers to 5.7
• Zeek plugins
  • added Corelight's Zerologon plugin to detect CVE-2020-1472
• Tweaks and bug fixes
  • Don't allow docker to mess with firewall rules in Malcolm ISO
  • Fix idaholab#26, ISO installers result in blank screen when booting with BIOS
  • Fix idaholab#24, install.py won't prompt to change ownership of extracted directory correctly if run as root
  • Leave some development packages in place in Hedgehog ISO so that Spicy plugins can be compiled

v2.3.0...v2.4.0

Malcolm and Hedgehog Linux may be obtained by pulling or building the Docker images and/or building the ISO installer images as described in the documentation. Unofficial ISO installer images for Malcolm and Hedgehog Linux are not hosted on GitHub, but may be downloaded from https://malcolm.fyi/download/.