scudette

 ### Extended Attribute 

# 1. Download https://github.com/jschicht/EaTools to C:\PerfLogs (this step was run previously if you ran our setup script)
https://github.com/jschicht/EaTools/raw/master/EaInject64.exe
https://github.com/jschicht/EaTools/raw/master/EaQuery64.exe

# 2. Add EA to file
copy C:\Windows\System32\calc.exe C:\PerfLogs\calc.exe
C:\PerfLogs\EaInject64.exe /Payload:C:\PerfLogs\calc.exe /Container:C:\PerfLogs\just_a_file.txt /Mode:0 /Identifier:NOTHINGTOSEEHERE

scudette

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Copyright 2015, Francesco "dfirfpi" Picasso <[email protected]>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0

scudette

function Get-InjectedThread
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION
    

scudette

// 
// File:   fsevents_windows.go
// Date:   October 29, 2013
// Author: Peter Krnjevic <[email protected]>, on the shoulders of many others
// 
// This code sample is released into the Public Domain.
//
package fsevents

import (

scudette

package main

import (
	"math/rand"
	"testing"
	"time"
)

const (
	numItems = 100 // change this to see how number of items affects speed