deadbits

rule Instruction_Bypass: PromptInjection
{
    meta:
        category = "Instruction Bypass"
        description = "Detects phrases used to ignore, disregard, or bypass instructions."

    strings:
        $bypass_phrase = /(Ignore|Disregard|Skip|Forget|Neglect|Overlook|Omit|Bypass|Pay no attention to|Do not follow|Do not obey)\\s*(prior|previous|preceding|above|foregoing|earlier|initial)?\\s*(content|text|instructions|instruction|directives|directive|commands|command|context|conversation|input|inputs|data|message|messages|communication|response|responses|request|requests)\\s*(and start over|and start anew|and begin afresh|and start from scratch)?/

    condition:

deadbits

# POC HH.exe - Device Guard bypass
# Oddvar Moe - https://msitpros.com
# Code execution with HH.exe / CHM files
# Code to generate CHM was borrowed from:
# https://raw.githubusercontent.com/samratashok/nishang/master/Client/Out-CHM.ps1
#https://gist.githubusercontent.com/api0cradle/95ae3c7120f16255d94088bd8959f4b2/raw/fa25b85e85bbb64c5cf021adf92b125357086a6f/GenerateCHM_1.0.ps1

$Outputpath = "C:\hhpoc"
   
#Create the table of contents for the CHM

deadbits

### Keybase proof

I hereby claim:

  * I am deadbits on github.
  * I am deadbits (https://keybase.io/deadbits) on keybase.
  * I have a public key ASA_T9AH10zpddleSnB4pzYn5nkf4VS3mBSJc5A1UnMTyQo

To claim this, I am signing this object:

deadbits

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa

deadbits

## Install Docker

```
# install the backported kernel
$ sudo apt-get update
$ sudo apt-get install linux-image-generic-lts-raring linux-headers-generic-lts-raring

$ sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9

$ sudo sh -c "echo deb https://get.docker.io/ubuntu docker main > /etc/apt/sources.list.d/docker.list"

deadbits

Install hfsprofs

sudo apt-get install hfsprogs

Mount / remount the HFS+ drive

sudo mount -t hfsplus -o force,rw /dev/sdxN /media/mntPoint or..
sudo mount -t hfsplufs -o remount,force rw /dev/sdxN /mount/mntPoint

Dealing with improperly mounted or corrupt drive

sudo fsck.hfsplus /dev/sdxN

deadbits

Verifying that "amsdbs.id" is my Blockstack ID. https://onename.com/amsdbs

deadbits

Verifying that "amsdbs.id" is my Blockstack ID. https://onename.com/amsdbs

deadbits

{"0.8860596202739888":"-----BEGIN PGP PUBLIC KEY BLOCK-----\r\nCharset: UTF-8\r\n\r\nxv8AAABSBAAAAAATCCqGSM49AwEHAgMEU5ZmbeeUKwyOJ3v5azKjP4O5CS41Pn1x\r\nTfqHHZ/v9lp8QfZu6HoTajhoEDoVIqXNB3EJh+Cu1wwGTr2d+FZCfM3/AAAACDxn\r\naXRodWI+wv8AAACOBBATCABA/wAAAAWCV/6gRv8AAAACiwn/AAAACZC7gUej3gND\r\nS/8AAAAFlQgJCgv/AAAABJYDAQL/AAAAApsD/wAAAAKeAQAAmR4A/1/uFhVw6uQp\r\ntSIcAeboRx096B8f3d9AdgFIwKZsoflTAQCSl1GogGRTEHvhcNFIvv7GcG/9wYs4\r\n3g1DfC1TiITlxs7/AAAAVgQAAAAAEggqhkjOPQMBBwIDBEvpEO0sZG0gtUvUVmIM\r\n88oHsfafZBjnsiAgbAqhliVqfFGS0kxcq+y6HaIIezwv/01ztwILHsxZlS2hfEWL\r\n1TEDAQgHwv8AAABtBBgTCAAf/wAAAAWCV/6gRv8AAAAJkLuBR6PeA0NL/wAAAAKb\r\nDAAAT1sBAIYloqmelecTEbeAITM2zLBMkEOc6gdsb+mQjaqfLtyaAQCMgIZhsBob\r\nLWTPkNrbsIVlUZ7LrIiOSh3S1sm2yYYnKg==\r\n=5tLS\r\n-----END PGP PUBLIC KEY BLOCK-----\r\n"}

deadbits

### Keybase proof

I hereby claim:

  * I am deadbits on github.
  * I am deadbits (https://keybase.io/deadbits) on keybase.
  * I have a public key whose fingerprint is 01ED C31F 32E4 5485 EF76  9E25 A88F 2B93 A135 1871

To claim this, I am signing this object: