mbrownnycnyc

regex to match NetBIOS domain and hostname as per MSFT documentation

https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and

#input: [domain]\[hostname]
(?P<name_domain>^[^\\/:*?\"<>|]*\w{1,63})\\(?P<name_root>[^\\/:*?\"<>|]*\w{1,63}$)

#Splunk rex:
| rex field=name "(?P^[^\\/:*?\"&lt;&gt;|]*\w{1,63})\\\(?P[^\\/:*?\"&lt;&gt;|]*\w{1,63}$)"

mbrownnycnyc

Proofpoint secure share:
https://secureshare.proofpoint.com/share/Main.htm

mbrownnycnyc

#references
I noticed that https://github.com/kitakar5525 also has a Surface Book Gen 1, which is great, because he's a kernel dev, and I am not.

# prep work
Make sure you have your bitlocker recovery key.  This is VERY important if you want to mess around with boot settings in Windows 10.  Once you disable secure boot, Windows will prompt you for this key.  You could also have disabled Bitlocker, but why?
Download the pop!_os nvidia iso.  I am working with 1804 LTS.
Download etcher and avoid the headache and use a USB stick to flash not an SD card.
Use diskmgmt.msc (etc) to shrink your Windows partition so you free some space.  I have a 512GB disk with a 400GB partition used for Windows system, but I'm only using about 100GB.  I split that in half and freed 200GB in unallocated space for the pop!_os instance.  

# Create a new EFI Partition and create new Windows EFI files for the running Windows instance

mbrownnycnyc

      <form>
       <label>Activity Audit</label>
       <fieldset submitButton="false">
         <input type="time" token="time" searchWhenChanged="true">
           <label>Time Range</label>
           <default>
             <earliest>-60m@m</earliest>
             <latest>now</latest>
           </default>
         </input>

mbrownnycnyc

<#1) copy over Rapid7Nexpose and Indented.Net.IP to a path in $env:psmodulePath, and install the OrionSDK https://github.com/solarwinds/OrionSDK/releases
2) store your password in a securestring
# https://blogs.technet.microsoft.com/robcost/2008/05/01/powershell-tip-storing-and-using-password-credentials/

$nscusername = "matt.brown"
$(read-host -assecurestring | convertfrom-securestring) | out-file .\Desktop\nscsstr.txt

#the securestring is encrypted against the personal key of the user for which is run using DPAPI 
#  https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Security/ConvertFrom-SecureString?view=powershell-5.1#description
#  http://www.griffinscs.com/?p=12

mbrownnycnyc

<#
  .SYNOPSIS
  This script contains functions that will use a few APIs in order to query subnet data from Orion's Solarwinds IPAM and Rapid7's Nexpose/InsightVM.
  
  .DESCRIPTION
  To setup the environment, perform the following:
1) find a host that supports powershell and can run scheduled tasks (note that securestrings are only secure on Windows platforms according to docs: https://docs.microsoft.com/en-us/dotnet/api/system.security.securestring?view=netframework-4.8#how-secure-is-securestring)

2) copy over Rapid7Nexpose and Indented.Net.IP to a path in $env:psmodulePath, and install the OrionSDK https://github.com/solarwinds/OrionSDK/releases

mbrownnycnyc

function test-subnetiscontained {  

  [CmdletBinding()] 

  param (  

  [ipaddress] $needleip, 

  [ipaddress] $needlemask, 

mbrownnycnyc

$userfqdn = "matt-surface\scanner"

$targetfolder = "C:\Users\Matt\Desktop\hassio"

$acl = get-acl $targetfolder
$acl.setaccessruleprotection($false, $false)

# FileSystemRights enum: https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.filesystemrights?view=netframework-4.7.2
# InheritanceFlags enum: https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.inheritanceflags?view=netframework-4.7.2
$ruleReadOnly = New-Object System.Security.AccessControl.FileSystemAccessRule($userfqdn,"ReadAndExecute", "ContainerInherit, ObjectInherit", "None", "Allow")

mbrownnycnyc

function lookup-wellknownsid {

  [cmdletbinding()]
  param (
    $sid
  )
  
  #https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems

$wellknownsids = @"

mbrownnycnyc

<# https://help.rapid7.com/insightvm/en-us/api/index.html

-- open ports custom report --
SELECT da.ip_address, da.host_name, dos.name AS OS, dos.version AS os_version, das.port, dp.name AS protocol, ds.name AS service, dsf.name AS service_name, dsf.version AS service_version
FROM dim_asset_service das
   JOIN dim_service ds USING (service_id)
   JOIN dim_protocol dp USING (protocol_id)
   JOIN dim_asset da USING (asset_id)
   JOIN dim_operating_system dos USING (operating_system_id)
   JOIN dim_service_fingerprint dsf USING (service_fingerprint_id)