Florian Roth Neo23x0

VT Dorks to Find Samples Signed with Leaked NVIDIA Certificates

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Guide by Florian Roth

I've transformed this gist into a git repository.

Whenever you research a certain vulnerability ask yourself these questions and please answer them for us

Does the exploited service write a log?
(check ls -lrt /var/log or lsof +D /var/log/ or lsof | grep servicename)

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

	https://thedfirreport.com/
	https://www.zerodayinitiative.com/blog/
	https://codewhitesec.blogspot.com/
	https://www.digitalshadows.com/blog-and-research/
	https://blog.talosintelligence.com/
	https://www.riskiq.com/blog/
	https://www.sekoia.io/en/blog-sekoia-io/
	https://www.nextron-systems.com/blog/
	https://www.microsoft.com/security/blog/
	https://blog.truesec.com/

	import hashlib
	import re

	def calculate_rule_hash(rule):
	"""
	Calculates a hash over the relevant YARA rule content (string contents, sorted condition)
	Requires a YARA rule object as generated by 'plyara': https://github.com/plyara/plyara
	:param rule: yara rule object
	:return hash: generated hash
	"""


	rule SUSP_Netscaler_Forensic_Artefacts {
	meta:
	description = "Detects strings / forensic artefacts on exploited Netscaler systems"
	author = "Florian Roth"
	reference = "https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/"
	date = "2020-01-14"
	score = 70
	strings:
	$ = "shell_command=\"whoami\"" ascii

	# ################################################################################
	# IMPORTANT NOTE
	# The most recent version of this POC rule can now be found in the main repository
	# https://github.com/Neo23x0/sigma/blob/master/other/godmode_sigma_rule.yml
	# ################################################################################
	# _____ __ __ ___ __
	# / ___/__ ___/ / / \|/ /__ ___/ /__
	# / (_ / _ \/ _ / / /\|_/ / _ \/ _ / -_)
	# \___/\___/\_,_/ /_/ /_/\___/\_,_/\__/_
	# / __(_)__ ___ _ ___ _ / _ \__ __/ /__

	import itertools
	s = "cmd.exe"
	list(map(''.join, itertools.product(*zip(s.upper(), s.lower()))))