J midnightslacker

Keybase proof

I hereby claim:

I am midnightslacker on github.
I am midnightslacker (https://keybase.io/midnightslacker) on keybase.
I have a public key whose fingerprint is 17D4 A849 D70D F157 C88C B856 8ED1 DA8C AB57 E621

To claim this, I am signing this object:

Use these rapid keyboard shortcuts to control the GitHub Atom text editor on Mac OSX.

Key to the Keys

⌘ : Command key
⌃ : Control key
⌫ : Delete key
← : Left arrow key
→ : Right arrow key
↑ : Up arrow key

How to Build a Cuckoo Sandbox Malware Analysis System

I had a heck of a time getting a Cuckoo sandbox running, and below I hope to help you get one up and running relatively quickly by detailing out the steps and gotchas I stumbled across along the way. I mention this in the references at the end of this gist, but what you see here is heavily influenced by this article from Nviso

Build your Linux Cuckoo VM

Setup a Ubuntu 16.04 64-bit desktop VM (download here) in VMWare with the following properties:

100GB hard drive
2 procs
8 gigs of RAM

openssl

Install

Install the OpenSSL on Debian based systems

sudo apt-get install openssl

	sudo apt-get install -y supervisor

	sudo mkdir /usr/share/elasticsearch
	cd /usr/share/elasticsearch

	sudo wget https://download.elasticsearch.org/kibana/kibana/kibana-4.0.1-linux-x64.tar.gz
	sudo wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.4.4.tar.gz
	sudo wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz

	sudo tar -zxvf elasticsearch-0.90.0.tar.gz

	# Carbon Black Evil PowerShell LSASS Query
	#
	# Prints out malicious Powershell events that have a crossproc event for c:\windows\system32\lsass.exe
	#
	# Author: Jason Lang (@curi0usJack)
	#
	# Prereqs (Windows 10)
	# Install bash on Win10
	# sudo apt-get install python-pip
	# sudo pip install --upgrade requests

	filter Expand-DefenderAVSignatureDB {
	<#
	.SYNOPSIS

	Decompresses a Windows Defender AV signature database (.VDM file).

	.DESCRIPTION

	Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.

	https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/support.html#Support.Client.describe_trusted_advisor_check_result

	{
	'result': {
	'checkId': 'string',
	'timestamp': 'string',
	'status': 'string',
	'resourcesSummary': {
	'resourcesProcessed': 123,
	'resourcesFlagged': 123,

	#!/usr/bin/python3
	import random

	name = ['Jack-Rabbit', 'Elephant', 'Donkey', 'Walrus']
	seed = random.randint(1,120)

	names = random.sample(name, len(name))

	print(names)

	# ---------------------------------------------------------------------------
	#
	# Description: This file holds all my BASH configurations and aliases
	#
	# Sections:
	# 1. Environment Configuration
	# 2. Make Terminal Better (remapping defaults and adding functionality)
	# 3. File and Folder Management
	# 4. Searching
	# 5. Process Management