Skip to content

Instantly share code, notes, and snippets.

View NeodymiumPhish's full-sized avatar

NeodymiumPhish NeodymiumPhish

2 followers · 5 following
View GitHub Profile
@ureddy-uptycs
ureddy-uptycs / osquery_yara_rule.sql
Created December 13, 2021 03:11
A SQL query that can be run as a realtime query in osquery to detect if java processes running on a host have opened log files that contain the yara signature specified in the query. The yara rules are used to detect log4j vulnerability CVE-2021-44228
SELECT *
FROM yara
WHERE
(path IN (SELECT path FROM process_open_files WHERE pid IN (SELECT pid FROM processes WHERE name = 'java') AND path LIKE '%.log' AND path NOT LIKE '%kafka%')
OR path LIKE '/var/log/%%' )
AND (
rule = 'rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
meta:
description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
author = "Florian Roth"
@jaredcatkinson
jaredcatkinson / Get-InjectedThread.ps1
Last active April 24, 2025 15:06
Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone
function Get-InjectedThread
{
<#
.SYNOPSIS
Looks for threads that were created as a result of code injection.
.DESCRIPTION