mrz-secops-offsec jonz-secops

Sarah Edwards (@iamevltwin)
Unified Log
- Howard Oakley @howardnoakley
  - Unified log: 1 why, what and how
  - Unified log: 2 content and extraction
Unified log: 3 finding your way

People

`:bowtie:`	😄 `:smile:`	😆 `:laughing:`
😊 `:blush:`	😃 `:smiley:`	☺️ `:relaxed:`
😏 `:smirk:`	😍 `:heart_eyes:`	😘 `:kissing_heart:`
😚 `:kissing_closed_eyes:`	😳 `:flushed:`	😌 `:relieved:`
😆 `:satisfied:`	😁 `:grin:`	😉 `:wink:`
😜 `:stuck_out_tongue_winking_eye:`	😝 `:stuck_out_tongue_closed_eyes:`	😀 `:grinning:`
😗 `:kissing:`	😙 `:kissing_smiling_eyes:`	😛 `:stuck_out_tongue:`

Tabs and Windows

Function	Shortcut
New Tab	`⌘` + `T`
Close Tab or Window	`⌘` + `W` (same as many mac apps)
Go to Tab	`⌘` + `Number Key` (ie: `⌘2` is 2nd tab)
Go to Split Pane by Direction	`⌘` + `Option` + `Arrow Key`
Cycle iTerm Windows	`⌘` + `backtick` (true of all mac apps and works with desktops/mission control)

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

	a4b.amazonaws.com
	access-analyzer.amazonaws.com
	account.amazonaws.com
	acm-pca.amazonaws.com
	acm.amazonaws.com
	airflow-env.amazonaws.com
	airflow.amazonaws.com
	alexa-appkit.amazon.com
	alexa-connectedhome.amazon.com
	amazonmq.amazonaws.com

	#!/bin/sh
	# Build llama.cpp on Fedora 40 and later
	# Tested with `docker run -it --device=/dev/dri --device=/dev/kfd --security-opt seccomp=unconfined --volume $HOME:/mnt/home fedora:40`

	dnf -y update
	dnf -y install hipcc rocm-hip-devel rocblas-devel hipblas-devel git cmake g++ lld clang-tools-extra llvm
	git clone https://github.com/ggerganov/llama.cpp.git
	cd llama.cpp/
	git checkout b2110
	CC=clang CXX=clang++ cmake -H. -Bbuild -DLLAMA_HIPBLAS=ON -DAMDGPU_TARGETS="gfx1030;gfx1100;gfx1101;gfx1102" -DCMAKE_BUILD_TYPE=Release

	# Run cvemap with our desired flags and output to json
	# I needed to run this with cvemap version 0.0.2 as 0.0.3 broke the ability to pipe to a file for whatever reason
	.\cvemap.exe -severity=critical -severity=high -es '> 0.01' -poc=true -l 1000 -json > new_vulns.json

	# Paths to the JSON files
	$newJsonFilePath = "new_vulns.json"
	$databaseJsonFilePath = "cve_database.json"

	# Read the newly fetched JSON file
	$newJsonContent = Get-Content -Path $newJsonFilePath \| ConvertFrom-Json

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

	# PowerShell Audit Logging for LogRhythm SIEM - 2015
	# For detecting dangerous PowerShell Commands/Functions

	Log Source Type:
	MS Event Log for Win7/Win8/2008/2012 - PowerShell

	Add this file to your PowerShell directory to enable verbose command line audit logging
	profile.ps1
	$LogCommandHealthEvent = $true
	$LogCommandLifeCycleEvent = $true