Skip to content

Instantly share code, notes, and snippets.

View sopsmattw's full-sized avatar

Matt Wagenknecht sopsmattw

10 followers · 21 following
View GitHub Profile
@sopsmattw
sopsmattw / 0_CyberChef_CobaltStrike_Shellcode_Decoder_Recipe
Created July 22, 2021 18:01 — forked from 0xtornado/0_CyberChef_CobaltStrike_Shellcode_Decoder_Recipe
CyberChef recipe to extract and decode Shellcode from a Cobalt Strike beacon
[{"op":"Conditional Jump","args":["bxor",false,"Decode_Shellcode",10]},{"op":"Label","args":["Decode_beacon"]},{"op":"From Base64","args":["A-Za-z0-9+/=",true]},{"op":"Decode text","args":["UTF-16LE (1200)"]},{"op":"Regular expression","args":["User defined","[a-zA-Z0-9+/=]{30,}",true,true,false,false,false,false,"List matches"]},{"op":"From Base64","args":["A-Za-z0-9+/=",true]},{"op":"Gunzip","args":[]},{"op":"Label","args":["Decode_Shellcode"]},{"op":"Regular expression","args":["User defined","[a-zA-Z0-9+/=]{30,}",true,true,false,false,false,false,"List matches"]},{"op":"Conditional Jump","args":["",false,"",10]},{"op":"From Base64","args":["A-Za-z0-9+/=",true]},{"op":"XOR","args":[{"option":"Decimal","string":"35"},"Standard",false]}]
@sopsmattw
sopsmattw / macOS-IR-Forensics.md
Created August 2, 2021 19:10 — forked from 0xmachos/macOS-IR-Forensics.md
If someone wants to learn MacOS IR/forensics what’s the best resource for that?
@sopsmattw
sopsmattw / gist:edcb911046f1f28764027c5a70238666
Created March 30, 2023 03:36 — forked from HumanEquivalentUnit/gist:9756f97bc67d2a0807993c05e426a436
# Map URLs to Internet Explorer Security Zones via PowerShell
$csSource = @'
using System;
using System.Runtime.InteropServices;
using System.Runtime.InteropServices.ComTypes;
public class IEZones
{