wdormann

import socket
import os

def main():
    # Create a Unix Datagram (DGRAM) socket
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)

    # Bind the socket to a file
    socket_path = './sock'
    if os.path.exists(socket_path):

wdormann

rule PathSegmentLNK {
strings:
        $lnk_header = { 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
        $exe_string = ".exe" nocase
        $c_drive = "c:\\" nocase
    condition:
        $lnk_header at 0 and
        for any i in (0x80..0xC0): (
            uint8(i) == 0x5C and
            for any j in (i+1..0xC0): (uint8(j) == 0x5C)

wdormann

import subprocess
import re
import time
import os
from collections import defaultdict

# Function to get the kernel version
def get_kernel():
    result = subprocess.Popen(['uname', '-a'], stdout=subprocess.PIPE)
    output, _ = result.communicate()

wdormann

# Ensure the profile path exists
if (!(Test-Path -Path $PROFILE)) {
    New-Item -Type File -Path $PROFILE -Force
}

# Define the content to add to the profile
$profileContent = @'
function Invoke-CMDDir {
    $cmdArgs = @('/c', 'dir') + $args
    & cmd.exe $cmdArgs

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 87:

The parameter is incorrect.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 4551:

Your organization used Device Guard to block this app. Contact your support person for more info.

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 87:

The parameter is incorrect.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 2148204812:

A certificate was explicitly revoked by its issuer.

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 577:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 4551:

Your organization used Device Guard to block this app. Contact your support person for more info.

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 577:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 2148204812:

A certificate was explicitly revoked by its issuer.

wdormann

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Aspose.Email;

namespace msgtotnef
{
    class Program

wdormann

<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy" PolicyType="Base Policy">
  <VersionEx>10.0.0.0</VersionEx>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:Unsigned System Integrity Policy</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Audit Mode</Option>