mgreen27

-- Tag machines by name, modify for other tagging usecases
LET target_clients = ( 'machinename1','machinename2'... )

SELECT 
    os_info.hostname as Hostname,
    os_info.fqdn as Fqdn,
    os_info.release as OS,
    timestamp(epoch=first_seen_at) as FirstSeen,
    timestamp(epoch=last_seen_at) as LastSeen,
    last_ip,

mgreen27

-- add API key here
LET APIKey = 'REDACTED'

-- firstly Materialize all entries for performance
LET all_entries <= SELECT 
            Fqdn,ClientId,
            `Entry Location` as EntryLocation,
            Entry,Enabled,Profile,Description,Company,
            `Image Path` as ImagePath,
            Version,

mgreen27

#!/bin/bash
# Extract unallocated with TSK

# Version: 0.1
# Date: 2020-05-14
# Author: @mgreen27

# Instructions
#   1. run against image: $ deletedEvtx.sh $IMAGE $OUTPATH
# or remove comment for hardcoded image name and path

mgreen27

 ### NTFS exercise setup

## 1. download some files to test various content and add ADS to simulate manual download from a browser

$downloads = ( 
    "https://live.sysinternals.com/PsExec64.exe",
    "https://live.sysinternals.com/procdump64.exe",
    "https://live.sysinternals.com/sdelete64.exe",
    "https://github.com/limbenjamin/nTimetools/raw/master/nTimestomp_v1.2_x64.exe"
)

mgreen27

name: Custom.ETW.Testing
description: |
    This artifact uses the ETW provider:
    Microsoft-Windows-Kernel-File {edd08927-9cc4-4e65-b970-c2560fb5c289} 

type: CLIENT_EVENT

parameters:
  - name: FilePathRegex
    description: "FilePath regex filter for"

mgreen27

name: Custom.Server.Malware.JoeSandbox
description: |
   This is a POC to submit a sample to JoesSandbox.
   No options beyont TAC and API have been configured.

type: SERVER

parameters:
   - name: JoeSandboxUrl
     default: https://www.joesandbox.com/api/v2/submission/new

mgreen27

{
    "Frontend": {
        "hostname": "",
        "bind_address": "0.0.0.0",
        "bind_port": 443,
        "public_path": "/opt/velociraptor/PUBLICTEMPLATE",
        "default_client_monitoring_artifacts": [
            "Generic.Client.Stats"
        ],
        "dyn_dns": {

mgreen27

<?xml version='1.0' encoding='windows-1252'?>
<?define AppRegKey="Software\COMPANYNAME\TOOLNAME" ?>
<?define PackageDescription="COMPANYNAME TOOLNAME installer" ?>
<?define Manufacturer="COMPANYNAME" ?>
<?define Name="TOOLNAME" ?>
<?define Version="VERSION" ?>
<?define BinaryName="TOOLNAME.exe" ?>
<?define BinaryNamex86="TOOLNAMEx86.exe" ?>

<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'>

mgreen27

name: Custom.Windows.EventLogs.Bitsadmin
author: "Matt Green - @mgreen27"
description: |
    This content will extract BITS Transfer events and enable filtering by URL

reference:
  - https://attack.mitre.org/techniques/T1197/
  - https://mgreen27.github.io/posts/2018/02/18/Sharing_my_BITS.html

parameters:

mgreen27

Table of Contents

• 0.1. References
  • 0.2. Other cheatsheets
  • 0.3. Manage multiple gcloud config configurations
    • 0.3.1. Switch gcloud context with gcloud config
  • 0.4. Auth
• 0.5. info