keyboardcrunch

IndicatorName In ( "ServiceCreate" ) AND IndicatorMetadata RegExp "ServiceName: \"[a-zA-Z]{6,8}\"$" AND SrcProcName Not In ( "msiexec.exe" , "ccmsetup.exe" , "SetupRST.exe" , "Uninstap.exe" , "CcmEval.exe" , "TSManager.exe" , "CcmExec.exe" , "wuauclt.exe" ) AND IndicatorMetadata RegExp "^ServiceName: (\".*(?<!DeviceInstall|TrustedInstaller|Netlogon|wuauserv|ccmsetup|WManSvc|Winmgmt|CipcCdp|atashost|vpnagent|Dnscache|cplspcon|acnamfd|ancrcl|IISADMIN|gupdatem|gupdate|CcmExec)\")$"

keyboardcrunch

keyboardcrunch

Sha256 In ("2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd", "47DDED0EFC230C3536F4DB1E2E476AFD3EDA8D8EA0537DB69D432322CDBAC9CA") OR IP In ("95.213.165.20", "159.148.186.228", "194.76.225.46", "185.158.250.216", "45.11.180.153", "194.76.225.61") OR DnsRequest In ("minexmr.com", "citationsherbe.at")

keyboardcrunch

from pyattck import Attck

attack = Attck()

for technique in attack.enterprise.techniques:
    print("# " + technique.name)
    for subtechnique in technique.subtechniques:
        if "Linux" in subtechnique.platforms:
 print("## " + subtechnique.id + " " + subtechnique.name)

keyboardcrunch

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.007/T1003.007.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1014/T1014.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.001/T1027.001.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.002/T1027.002.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1030/T1030.yaml
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.yaml

keyboardcrunch

SentinelOne Resources

This is just a list of unofficial SentinelOne resources, anything that helps with administration, deployment, automation, or queries.

Custom Rules and Queries

Frameworks

• @fragtastic - Python S1 Framework
• @mdejongh - SentinelOne ELK data importer

keyboardcrunch

#!/usr/bin/python3
'''
script to merge netmaker clients from all bound networks into the
local system's hosts file.
'''

import subprocess
import json

HOST_FILE = '/etc/hosts'

keyboardcrunch

#!/bin/bash

VMWARE_VERSION="workstation-$(vmware -v|grep -oE "[[:digit:]]+.[[:digit:]]+.[[:digit:]]+"| head -n1)" # this is detect the version you have VMware Workstation 16.2.1 build-18811642

TMP_FOLDER=/tmp/patch-vmware
rm -fdr $TMP_FOLDER
mkdir -p $TMP_FOLDER
cd $TMP_FOLDER
git clone https://github.com/mkubecek/vmware-host-modules.git
cd $TMP_FOLDER/vmware-host-modules

keyboardcrunch

apt update
apt install -y apt-transport-https ca-certificates curl software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
apt update
apt install -y docker-ce docker-compose
usermod -aG docker ${USER}
systemctl start docker.service
docker ps

keyboardcrunch

$ChocoFile = Join-Path -Path $(Get-Location) -ChildPath "choco_config.txt"
$ChocoFileSettings = @'
# Software
choco install adobereader
choco install googlechrome
choco install firefox
choco install 7zip.install

# runtimes
choco install adoptopenjdk12