Skip to content

Instantly share code, notes, and snippets.

View pedramamini's full-sized avatar
👋

Pedram Amini pedramamini

👋
View GitHub Profile
#### Sigma Rule: Initial Access via Social Engineering and RMM Tool Installation
```yaml
title: Initial Access via Social Engineering and RMM Tool Installation
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects the installation of Remote Monitoring and Management (RMM) utilities following social engineering attacks, which may indicate initial access by threat actors.
status: experimental
author: Your Name
logsource:
category: process_creation
product: windows
@pedramamini
pedramamini / ped_sitrip.md
Last active August 1, 2024 16:08
Give me a precise and concise report from the provided content.

Identity and Purpose

You are the worlds greatest content summarizer with an IQ of 479. You've been hired by the President of the United States of America to act as the official summarizer of all content that she's to read. To accomplish this job well you must be both PRECISE and CONCISE. Do not lose any information, but exercise extreme brevity when relaying that information. Spend 8 virtual hours following this step-by-step methodology and then producing a report following the Template defined below, finally read in the content to summarize under the Input section.

Step-by-Step Methodology

  1. Initial Reading and Understanding
    • Objective: Grasp the core message and main points.
    • Action: Read the entire document quickly to get an overview.
  2. Identify Key Sections
  • Objective: Locate sections with essential information.
@pedramamini
pedramamini / ped_bjj_glossary.md
Created June 11, 2024 02:23
These prompts and bash script provide a pipeline for downloading, transcribing, and summarizing videos from my YouTube playlist into my Obsidian notebook.

IDENTITY and PURPOSE

You are a No-Gi Brazilian Jiu Jitsu Black belt who is fluent in Japanese and knows all the modern day positional lingo.

You'll be creating a glossary of No-Gi BJJ terminology.

Take a deep breath and think step-by-step how to do the following STEPS.

STEPS

const ignoreFolders = ["YouTube"];
const ignoreContent = "Watched"; // Define the content to ignore

const results = dv.pages(`"/"`)
  .file.tasks
  .where(task => !ignoreFolders.includes(task.path.split("/")[0]) && !task.text.includes(ignoreContent));
const tasks = [...results].flat();

const completedTasks = tasks.filter(task => task.completed);
@pedramamini
pedramamini / fabric-multiplex.sh
Last active July 2, 2024 21:18
Multiplex the stdout from a command as the stdin to numerous commands, collect the outputs under command headings in markdown format.
#!/bin/bash
# Pedram Amini
# https://pedramamini.com
run_command() {
local cmd="$1"
local input_file="$2"
local output_file="$3"
@pedramamini
pedramamini / chrome_fetch.py
Last active March 27, 2024 21:41
CLI tool and library for fetching content via Chrome driven by Selenium. Has some tricks up its sleeve to evade mechanized browser detection.
"""
CLI tool and library for fetching content via Chrome driven by Selenium. Has some tricks up its sleeve to evade
mechanized browser detection.
Pedram Amini
https://pedramamini.com
Requirements:
pip install selenium
pip install webdriver_manager
#!/Users/pedram/venv3/bin/python
import os
import subprocess
import time
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
FABRIC = "/Users/pedram/Library/Caches/pypoetry/virtualenvs/fabric-S0sAxjxM-py3.12/bin/fabric"
PATTERNS = "/Users/pedram/Library/Mobile Documents/iCloud~md~obsidian/Documents/Pedsidian/Fabric/Patterns"
@pedramamini
pedramamini / cowsay-sticky.py
Last active June 20, 2023 17:28
Cowsay, but via Amazon's sticky note printer. See it in action: https://stickynote.pedramamini.com
#!/Users/pedram/venv3/bin/python
#
# The Amazon thermal sticky note printer is pretty useless as the interface is purely verbal. But...
# it does expose an IP Printing port (TCP 613). Took some finagling but I'm proud to present...
#
# Cowsay Sticky Note Edition!
#
# Feed programmatic notifications via CLI or host a simple web server to receive sticky notes from friends.
#
@pedramamini
pedramamini / google_vs_microsoft.py
Last active August 23, 2021 21:32
InQuest Labs: Trystero Project - Google vs Microsoft
#!/bin/env python
"""
Leverage the open API from labs.inquest.net to query the Trystero project data and compare which vendor, between
Google and Microsoft "won" the most days from the given YYYY-MM-DD to now. Example:
❯ python google_vs_microsoft.py 2021-06-01
since=2021-06-01 day=2021-08-16 (64) google=21 🏆microsoft=39
google 🏆 days: 21
microsoft 🏆 days: 39
@pedramamini
pedramamini / iq_auto_diff.py
Last active July 31, 2021 14:54
InQuest Labs Rule Generator
#!/opt/research/venv/bin/python
"""
IQ Auto DIFF leverages InQuest Labs API to collate a list of post DFI string features from both malicious (bad) and
seemingly benign (non) files. While ignoring gibberish, we'll next identify the string features exclusive to each set.
The idea is that the top 25 strings found from the malicious (mal) corpus can be inclusive for a YARA rule where the
top 25 strings from the seemingly benign (non) corpus can be exclusive for a YARA rule.
This script will take upwards of 20 minutes to run.