Neo23x0

VT Dorks to Find Samples Signed with Leaked NVIDIA Certificates

References: https://twitter.com/cyb3rops/status/1499514240008437762 https://twitter.com/GossiTheDog/status/1499781976835993600

More background: https://twitter.com/FuzzySec/status/1499462430275084307

All files signed with the certificates

Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Neo23x0

Minecraft in Beautiful

Guide by Florian Roth

Buy the JAVA Version of Minecraft - not the Windows 10 Bedrock version

https://www.minecraft.net/en-us/store/minecraft-java-edition/

Install JAVA

Neo23x0

I've transformed this gist into a git repository.

---

Whenever you research a certain vulnerability ask yourself these questions and please answer them for us

Logging

Does the exploited service write a log?
(check ls -lrt /var/log or lsof +D /var/log/ or lsof | grep servicename)

Neo23x0

import hashlib
import re

def calculate_rule_hash(rule):
    """
    Calculates a hash over the relevant YARA rule content (string contents, sorted condition)
    Requires a YARA rule object as generated by 'plyara': https://github.com/plyara/plyara
    :param rule: yara rule object
    :return hash: generated hash
    """

Neo23x0

import itertools
s = "cmd.exe"
list(map(''.join, itertools.product(*zip(s.upper(), s.lower()))))

Neo23x0

rule SUSP_Netscaler_Forensic_Artefacts {
   meta:
      description = "Detects strings / forensic artefacts on exploited Netscaler systems"
      author = "Florian Roth"
      reference = "https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/"
      date = "2020-01-14"
      score = 70
    strings:
      $ = "shell_command=\"whoami\"" ascii

Neo23x0

# ################################################################################
# IMPORTANT NOTE
# The most recent version of this POC rule can now be found in the main repository 
# https://github.com/Neo23x0/sigma/blob/master/other/godmode_sigma_rule.yml
# ################################################################################
#    _____        __  __  ___        __      
#   / ___/__  ___/ / /  |/  /__  ___/ /__    
#  / (_ / _ \/ _  / / /|_/ / _ \/ _  / -_)   
#  \___/\___/\_,_/ /_/  /_/\___/\_,_/\__/_   
#    / __(_)__ ___ _  ___ _  / _ \__ __/ /__ 

Neo23x0

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
JAB	🗣 Jabber	$.	Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env:
TVq	📺 Television	MZ	MZ header
SUVY	🚙 SUV	IEX	PowerShell Invoke Expression
SQBFAF	🐣 Squab favorite	I.E.	PowerShell Invoke Expression (UTF-16)
SQBuAH	🐣 Squab uahhh	I.n.	PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA	💪 "Pah!"	<.	Often used by Emotet (UTF-16)

Neo23x0

title: Suspicious Keyboard Layout Load
description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
references:
    - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
author: Florian Roth
date: 2019/10/12
logsource:
    product: windows
    service: sysmon
    definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'