Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

byt3bl33d3r

#! /usr/bin/env python3

'''
    Needs Requests (pip3 install requests)

    Author: Marcello Salvati, Twitter: @byt3bl33d3r
    License: DWTFUWANTWTL (Do What Ever the Fuck You Want With This License)

    
    This should allow you to detect if something is potentially exploitable to the log4j 0day dropped on December 9th 2021.

fieldmapper

NOTE: Merged with openTAKpickList.

---

'openTAKpickList' - Team Awareness Kit (TAK) - related resources and links.

This is a list of web resources, hardware and software that can be used in conjunction with the Team Awareness Kit (TAK) platform.

Official TAK Resources

• TAK Product Center - New

adulau

Compression algorithms

• https://bellard.org/nncp/ - NNCP: Lossless Data Compression with Neural Networks
• https://www.byronknoll.com/cmix.html / https://github.com/byronknoll/cmix - CMIX cmix is a lossless data compression program aimed at optimizing compression ratio at the cost of high CPU/memory usage.
• https://tukaani.org/xz/ - XZ (LZMA)
• https://github.com/facebook/zstd - ZSTD

References

• http://www.mattmahoney.net/dc/text.html

unrealwill

import tensorflow as tf #We need tensorflow 2.x
import numpy as np

#The hashlength in bits
hashLength = 256

def buildModel():
    #we can set the seed to simulate the fact that this network is known and doesn't change between runs
    #tf.random.set_seed(42)
    model = tf.keras.Sequential()

righel

MISP Docker Dev Env

This is a short guide on how to set up a development environment for MISP using MISP/misp-docker docker images.

Prerequisites

1. Install docker and docker-compose.
2. Clone MISP project repo: git clone --recurse-submodules git@github.com:MISP/MISP.git
3. Clone MISP/misp-docker repo: git clone https://github.com/MISP/misp-docker.git
4. Clone MISP/PyMISP repo:

adulau

hashlookup.circl.lu

CIRCL hash lookup is a public API to lookup hash values against known database of files. NSRL RDS database is included. More database will be included in the future. The API is accessible via HTTP ReST API and the API is also described as an OpenAPI.

Get information about the hash lookup database (via ReST)

curl -X 'GET' \
  'https://hashlookup.circl.lu/info' \
 -H 'accept: application/json'

jipegit

SOLORIGATE

This gist is not updated anymore.

Updated data: https://github.com/jipegit/IncidentsMindMaps/tree/main/SOLORIGATE_SUNBURST

dannguyen

fetch_ghstars.py: quick CLI script to fetch and collate from Github API all of a user's starred repos

• Requires Python 3.6+
• Creates a subdir 'ghstars-USERNAME' at the current working directory
• the raw JSON of each page request is saved as: 01.json, 02.json 0n.json
• A flattened, filtered CSV is also created: wrangled.csv

Example usage:

aaronst

# C2 FQDNs
first seen fqdn
2019-12-11 23:37:10	updatemanagir.us
2019-12-20 17:51:05	cmdupdatewin.com
2019-12-26 18:03:27	scrservallinst.info
2020-01-10 00:33:57	winsystemupdate.com
2020-01-11 23:16:41	jomamba.best
2020-01-13 05:13:43	updatewinlsass.com
2020-01-16 11:38:53	winsysteminfo.com
2020-01-20 05:58:17	livecheckpointsrs.com