lctrcl

import re
from collections import namedtuple


ASCII_BYTE = " !\"#\$%&\'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\]\^_`abcdefghijklmnopqrstuvwxyz\{\|\}\\\~\t"


String = namedtuple("String", ["s", "offset"])

lctrcl

# build wine Docker image
pushd wine; docker build -t wine .; popd

# build x11 Docker image for IDA
pushd ida; docker build -t wine/ida .; popd

# demonstrate x11 forwarding works
run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix wine/ida xclock

# interactive shell in container

lctrcl

# Path setting slight of hand:
$: << File.expand_path("../../lib", __FILE__)
require 'packetfu'
require 'json'

capture_thread = Thread.new do
  cap = PacketFu::Capture.new(:iface => 'lo0', :start => true)
  cap.stream.each do |p|
    pkt = PacketFu::Packet.parse p
    if pkt.payload.include?("executeFillScript")

lctrcl

#!/usr/sbin/dtrace -s

syscall::read:entry
/execname == "sh"   || execname == "ksh"  || execname == "csh"  ||
 execname == "tcsh" || execname == "zsh"  || execname == "bash"/
{
        self->start = timestamp;
        self->buf = arg1;
        self->len = arg2;
}

lctrcl

{
  "packs": {
    "osxlockdown": {
      "platform": "darwin",
      "version": ".1",
      "queries": {
        "OS Updates": {
          "query": "select value from preferences where path = '/Library/Preferences/com.apple.SoftwareUpdate.plist' and key = 'LastSuccessfulDate';",
          "interval": "86400",
          "description": "Verify all Apple OS-bundled software has checked it's configured server recently",

lctrcl

$EventFilterArgs = @{
    EventNamespace = 'root/cimv2'
    Name = 'PowerShellProcessStarted'
    Query = 'SELECT FileName, ProcessID FROM Win32_ModuleLoadTrace WHERE FileName LIKE "%System.Management.Automation%.dll"'
    QueryLanguage = 'WQL'
}

$Filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $EventFilterArgs

$CommandLineConsumerArgs = @{

lctrcl

# PowerShell Audit Logging for LogRhythm SIEM - 2015
# For detecting dangerous PowerShell Commands/Functions

Log Source Type:
  MS Event Log for Win7/Win8/2008/2012 - PowerShell

Add this file to your PowerShell directory to enable verbose command line audit logging
profile.ps1
	$LogCommandHealthEvent = $true
	$LogCommandLifeCycleEvent = $true

lctrcl

*ExecuteShellCommand*
*GetDelegateForFunctionPointer*
*GetModuleHandle*
*GetProcAddress*
*Groups.User.Properties.cpassword*
*IMAGE_NT_OPTIONAL_HDR64_MAGIC*
*InteropServices.HandleRef*
*kernel32.dll*
*LSA_UNICODE_STRING*
*Management.Automation.RuntimeException*

lctrcl

function Subvert-CLRAntiMalware {
<#
.SYNOPSIS

A proof-of-concept demonstrating overwriting a global variable that stores a pointer to an antimalware scan interface context structure. This PoC was only built to work with .NET Framework Early Access build 3694.

.DESCRIPTION

clr.dll in .NET Framework Early Access build 3694 has a global variable that stores a pointer to an antimalware scan interface context structure. By reading the pointer at that offset and then overwriting the forst DWORD, the context structure will become corrupted and subsequent scanning calls will fail open.

lctrcl

<#
.SYNOPSIS

This script demonstrates the ability to capture and tamper with Web sessions.  
For secure sessions, this is done by dynamically writing certificates to match the requested domain. 
This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack. 

Function: Interceptor
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause