| title: Suspicious Keyboard Layout Load | |
| description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only | |
| references: | |
| - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index | |
| author: Florian Roth | |
| date: 2019/10/12 | |
| logsource: | |
| product: windows | |
| service: sysmon | |
| definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files' |
| /* | |
| WARNING: | |
| the newest version of this rule is now hosted here: | |
| https://github.com/Neo23x0/god-mode-rules/blob/master/godmode.yar | |
| */ | |
| /* | |
| _____ __ __ ___ __ |
| import hashlib | |
| import re | |
| import plyara | |
| # Florian Roth, Christian Burkard | |
| # Version 3.0 | |
| # January 2023 | |
| # | |
| # Known issues: fails in some cases in which 'private' rules are used |
Use Manage Search Engines in your browser to add these search engines. You can then use the 'keyword' in the URL bar to do a quick lookup. Find more details about managing your search engines in Chrome here.
e.g. Type
v dad8ebcbb5fa6721ccad45b81874e22c
| # Product Requirements | |
| PRODUCT_REQUIREMENTS = { | |
| "FireEyeAX": { | |
| "maximum_version": "3.4.0", | |
| "supported_modules": [], # assumption | |
| "with_crypto": True, # assumption | |
| }, | |
| "FireEyeNX": { | |
| "maximum_version": "3.4.0", | |
| "supported_modules": [], # assumption |
| #!/bin/python3 | |
| import os | |
| import sys | |
| import argparse | |
| import logging | |
| import re | |
| import platform | |
| MONTHS = { |
| #!/bin/bash | |
| # | |
| # Fixes error: | |
| # git: 'secrets' is not a git command. See 'git --help'. | |
| # | |
| # 1. Go to SourceTree preferences > Git > Use System Git | |
| # Select the system's git e.g. /usr/local/git/bin/git | |
| # 2. Run this script | |
| # Adust the path if your system's git is located in a different folder | |
| # git-secrets must be linked in the same folder as the system's git binary |
| Linux | |
| (strings -a -td "$@" | sed 's/^\(\s*[0-9][0-9]*\) \(.*\)$/\1 A \2/' ; strings -a -td -el "$@" | sed 's/^\(\s*[0-9][0-9]*\) \(.*\)$/\1 W \2/') | sort -n | |
| macOS | |
| (gstrings -a -td "$@" | gsed 's/^\(\s*[0-9][0-9]*\) \(.*\)$/\1 A \2/' ; gstrings -a -td -el "$@" | gsed 's/^\(\s*[0-9][0-9]*\) \(.*\)$/\1 W \2/') | sort -n |
| # This GIST has been transformed into a Git repository and does not receive updates anymore | |
| # | |
| # Please visit the github repo to get a current list | |
| # https://github.com/Neo23x0/ti-falsepositives/ | |
| # Hashes that are often included in IOC lists but are false positives | |
| HASH_WHITELIST = [ | |
| # Empty file | |
| 'd41d8cd98f00b204e9800998ecf8427e', | |
| 'da39a3ee5e6b4b0d3255bfef95601890afd80709', |
| [^\x00-\x7E] |