Nemesis 2.2 Adds Large-Container Processing, LLM Agents and Expanded DPAPI Support
Summary
Nemesis 2.2 adds large-container processing, optional LLM-assisted analysis, faster processing, host-level file linking and reporting, and support for decrypting Chromium cookies and logins protected with DPAPI and app-bound encryption.
Key points
- Nemesis can process large containers, including disk images, by extracting their files; YAML configuration supports metadata and file filters.
- Optional LLM agents support automated finding triage, credential analysis, document summarization and translation, .NET analysis, and chatbot queries. The authors recommend privacy-verified LLM providers.
- On the authors’ test machine, text-file processing improved from one file every 1.5–4 seconds to 10–30 files per second; results vary with workload and hardware.
- The release adds support for Chromium cookie and login decryption across DPAPI, app-bound encryption, and CNG-protected keys, provided the required files and credential material are available.
- A source field links related files by host, supports suggested file collection, and enables host-specific reports.
- Other additions include ZIP scanning of Git history, a Velociraptor collector, and alert settings that can be changed after deployment.
Article Details
- Event Type
- Software release
- Impact
- Nemesis 2.2 adds large-container and disk-image processing, optional LLM-assisted analysis, improved DPAPI handling, and support for decrypting Chromium browser cookies and logins. The release also adds file linking and host-specific reporting and improves processing performance. These features support both offensive operations and defensive triage of collected or exfiltrated data, including assessment of exposed credentials and potential access.
Products
ChromiumThe update significantly improves handling of Chromium browser data, including cookies, logins, and associated cryptographic files.EdgeThe Chromium Local State file from the same Chromium install (Chrome, Edge, etc.)Google ChromeUsers can submit all of these credential material components to Nemesis via Chrome/DPAPI -> Submit Credential Material:NemesisNemesis 2.2 introduces new features focused on large container processing, enhanced data agents, and improved DPAPI support for both offensive and defensive cybersecurity operations.
Tools
Nosey ParkerWhile we run Nosey Parker scans against all plaintext files and files that can have plaintext extracted, generic password/credential detection is a tough problem to solve in the general case.SleuthKitThese can be traditional things like zips, or forensic filesystem images that can be handled by the Python bindings for the SleuthKit (.dd images, etc.).VelociraptorSome of you may be familiar with the Velociraptor forensic project (some attackers certainly are!).