geekodour

SECURITY IN ORDERS OF DIFFICULTY

Not necessarily meant to be followed step by step, although it is recommended. Some steps are valid during all levels, others give way to better alternatives further on.

---

TOC

1. Basic Level Security
2. Cautionary Level Security
3. Medium Level Security
4. High Level Security

ajcwebdev

Outline

• Introduction and Other Resources
• Install Developer Applications
• Configure CLI
  • Install Homebrew and Brew Packages
  • Install Volta and Node Packages
  • Authenticate CLIs
  • Configure Git
• Common Workflows

HuangJiaLian

#!/bin/sh
# Ref.: https://www.pythonguis.com/tutorials/packaging-pyqt5-applications-pyinstaller-macos-dmg/

rm -rf build dist/*

#################################################
# Create app file using pyinstaller
#################################################

pyinstaller --name 'Huanbu' \

Samirbous

event.code:4688 and winlog.event_data.TargetUserSid :"S-1-0-0" and not winlog.event_data.TargetUserName:*$ and 
not winlog.event_data.TargetUserName:- and not winlog.event_data.TargetUserName:"defaultuser100000" and 
not winlog.event_data.TargetUserName : ("LOCAL SERVICE" or "NETWORK SERVICE") and 
not winlog.event_data.TargetDomainName : ("NT Service" or "Font Driver Host")

SwitHak

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

• If you want to add a link, comment or send it to me
• Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

• Royce Williams list sorted by vendors responses Royce List
• Very detailed list NCSC-NL
• The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

haircut

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadDisplayName</key>
                <string>Restrictions</string>
                <key>PayloadIdentifier</key>

oz9un

<Sysmon schemaversion="4.70">
  <EventFiltering>
    <!-- Event ID 3 == NetworkConnect Detected. Do not log anything!-->
    <RuleGroup name="" groupRelation="and">
        <NetworkConnect onmatch="exclude">
                <Protocol condition="is">tcp</Protocol>
                <Protocol condition="is">udp</Protocol>
                <DestinationPort condition="is">80</DestinationPort>
                <DestinationPort condition="is">443</DestinationPort>
        </NetworkConnect>

oz9un

<Sysmon schemaversion="4.70">
  <EventFiltering>
    <!-- BELOW PART DISABLES ALL OTHER LOGS FOR FIXING THE MESS!-->
    <!-- Event ID 1 == ProcessCreate. Log only ping process. -->
    <RuleGroup name="" groupRelation="or">
        <ProcessCreate onmatch="include"/>
    </RuleGroup>
    <!-- Event ID 3 == NetworkConnect Detected. Do not log anything!-->
    <RuleGroup name="" groupRelation="or">
        <NetworkConnect onmatch="include"/>

oz9un

<Sysmon schemaversion="4.70">
  <EventFiltering>
    <!-- Event ID 1 == ProcessCreate. Log only ping process. -->
    <RuleGroup name="pingDetected" groupRelation="or">
            <ProcessCreate onmatch="include">
                    <Image condition="is">/usr/bin/ping</Image>
                    <CommandLine condition="contains">ping</CommandLine>
            </ProcessCreate>
    </RuleGroup>