Olaf Hartong olafhartong

olafhartong / Enumerate-UrlSchemes.ps1

Created July 12, 2026 19:34 — forked from AlloySecureGroup/Enumerate-UrlSchemes.ps1

Scheme Hunter - Enumerate URI schemes and prototype invocation

	<#
	.SYNOPSIS
	Enumerates all registered URI/URL protocol handlers ("schemes") on a
	Windows endpoint and statically risk-scores them for potential
	execution-primitive abuse (cf. search-ms:, ms-officecmd:, and similar
	scheme-hijack findings).

	.DESCRIPTION
	Does NOT invoke any handler. Purely reads HKEY_CLASSES_ROOT and
	HKEY_CURRENT_USER\Software\Classes for keys that carry the

olafhartong / TLGMetadataParser.psm1

Created March 22, 2025 15:23 — forked from mattifestation/TLGMetadataParser.psm1

Retrieves TraceLogging metadata from a file.

	#requires -version 5

	<#
	The things you find on Google searching for specific GUIDs...

	Known Keyword friendly names:
	"UTC:::CATEGORYDEFINITION.MS.CRITICALDATA":"140737488355328"
	"UTC:::CATEGORYDEFINITION.MS.MEASURES":"70368744177664"
	"UTC:::CATEGORYDEFINITION.MS.TELEMETRY":"35184372088832"
	"UTC:::CATEGORYDEFINITION.MSWLAN.CRITICALDATA":"2147483648"

olafhartong / Get-InjectedThread.ps1

Created January 7, 2019 12:44 — forked from jaredcatkinson/Get-InjectedThread.ps1

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

olafhartong / bro-ids_logstash.conf

Last active August 29, 2015 14:19 — forked from mrlesmithjr/bro-ids_logstash.conf

	# Bro-IDS Logstash parser
	# Parts of this taken from http://www.appliednsm.com/wp-content/uploads/logstash-SObro22-parse.conf_.txt

	#Logs being parsed:
	#app_stats.log
	#conn.log
	#dns.log
	#dpd.log
	#files.log
	#http.log