Karib0u

Gmail Filters

Catch newsletters and junk

Matches: ("opt-out" OR unsubscribe OR "viewing the newsletter" OR "privacy policy" OR enews OR "edit your preferences" OR "email notifications" OR "update profile" OR smartunsubscribe OR secureunsubscribe OR yahoogroups OR "manage your account" OR "group-digests") Do this: Skip Inbox, Apply label "Work/Newsletters"

Keep pesky calendar invites out of inbox

Matches: (subject:("invitation" OR "accepted" OR "rejected" OR "updated" OR "canceled event" OR "declined") when where calendar who organizer) Do this: Skip Inbox, Apply label "GTD/Follow up"

Keep 90% of Sales emails out of Inbox

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

	:: Windows 10 Hardening Script
	:: This is based mostly on my own personal research and testing. My objective is to secure/harden Windows 10 as much as possible while not impacting usability at all. (Think being able to run on this computer's of family members so secure them but not increase the chances of them having to call you to troubleshoot something related to it later on). References for virtually all settings can be found at the bottom. Just before the references section, you will always find several security settings commented out as they could lead to compatibility issues in common consumer setups but they're worth considering.
	:: Obligatory 'views are my own'. :)
	:: Thank you @jaredhaight for the Win Firewall config recommendations!
	:: Thank you @ricardojba for the DLL Safe Order Search reg key!
	:: Thank you @jessicaknotts for the help on testing Exploit Guard configs and checking privacy settings!
	:: Best script I've found for Debloating Windows 10: https://github.com/Sycnex/Windows10Debloater
	:

	# IMPORTANT!
	# This gist has been transformed into a github repo
	# You can find the most recent version there:
	# https://github.com/Neo23x0/auditd

	# ___ ___ __ __
	# / \| __ ______/ (_) /_____/ /
	# / /\| \|/ / / / __ / / __/ __ /
	# / ___ / /_/ / /_/ / / /_/ /_/ /
	# /_/ \|_\__,_/\__,_/_/\__/\__,_/

	# Code from best solution in page below:
	# https://help.zoho.com/portal/community/topic/zoho-mail-servers-reject-python-smtp-module-communications

	import smtplib
	from email.mime.text import MIMEText
	from email.header import Header
	from email.utils import formataddr

	# Define to/from
	sender = '[email protected]'

	# Script author: Matt Graeber (@mattifestation)
	# logman start AMSITrace -p Microsoft-Antimalware-Scan-Interface Event1 -o AMSITrace.etl -ets
	# Do your malicious things here that would be logged by AMSI
	# logman stop AMSITrace -ets

	$OSArchProperty = Get-CimInstance -ClassName Win32_OperatingSystem -Property OSArchitecture
	$OSArch = $OSArchProperty.OSArchitecture

	$OSPointerSize = 32
	if ($OSArch -eq '64-bit') { $OSPointerSize = 64 }

	Set-ExecutionPolicy Unrestricted;
	iex ((New-Object System.Net.WebClient).DownloadString('http://boxstarter.org/bootstrapper.ps1'));
	get-boxstarter -Force;
	Install-BoxstarterPackage -PackageName 'https://gist.githubusercontent.com/OALabs/afb619ce8778302c324373378abbaef5/raw/4006323180791f464ec0a8a838c7b681f42d238c/oalabs_x86vm.ps1';

	Linux
	(strings -a -td "$@" \| sed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 A \2/' ; strings -a -td -el "$@" \| sed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 W \2/') \| sort -n

	macOS
	(gstrings -a -td "$@" \| gsed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 A \2/' ; gstrings -a -td -el "$@" \| gsed 's/^\(\s[0-9][0-9]\) \(.\)$/\1 W \2/') \| sort -n

	/*
	WARNING:

	the newest version of this rule is now hosted here:
	https://github.com/Neo23x0/god-mode-rules/blob/master/godmode.yar
	*/


	/*
	_____ __ __ ___ __

	<!--
	SilkService Config
	Author: Roberto Rodriguez (@Cyb3rWard0g)
	License: GPL-3.0
	Version: 0.0.1

	References: https://github.com/Cyb3rWard0g/mordor/blob/master/environments/windows/configs/erebor/erebor_SilkServiceConfig.xml
	-->
	<SilkServiceConfig>
	<!--