Wes wesinator

View tasks assigned to me that are not completed or deferred:

typeName in ("Task") and taskAssignee = me and taskStatus != "Completed" and taskStatus != "Deferred"

View internationalized domains:

typeName in ("Host", "URL") and summary contains "xn--"

View over 50 security blogs in ThreatConnect:

Add extension to files with no extension

find . -not -name "*.*" -exec mv -v "{}" "{}.ext" \;

[0]

text file

(appears to work on rendered plaintext, does not work on json response type (e.g. https://api.github.com) - browser JSON rendering controls get included in text).

i.e. document.contentType == "text/plain" :

document.documentElement.textContent
document.documentElement.innerText

html

(full html but not hash equivalent, changes case "!DOCTYPE"):

Some VBA notes

Tools

Unix(Remnux): viper.li, oletools, & Didier's tools
Windows: Office Excel (VBE) & Visual Studio Community (VSC), officemalscanner
Editors: scite, VS Code
d-scan
Vba2Graph

	{
	"request": [
	{
	"enable": true,
	"name": "McAfee Virusprofile",
	"ruleType": "redirect",
	"matchType": "regexp",
	"pattern": "https://home.mcafee.com/virusinfo/virusprofile.aspx\\?key=.*?",
	"exclude": "",
	"group": "Ungrouped",

	# update all packages for ipython / jupyter
	pip install -U ipython ipykernel jupyter jupyter-client notebook jupyter-console jupyter-core
	pip install -U jupyter-dashboards
	pip install -U jupyterlab jupyterlab-server

	// https://www.anomali.com/blog/analyzing-digital-quartermasters-in-asia-do-chinese-and-indian-apts-have-a-shared-supply-chain

	rule RTF_weaponizer_objh300
	{
	meta:
	author = "Anomali"
	tlp = "GREEN"
	version = "1.0"
	date = "2018-11-13"
	hash = "9d0c4ec62abe79e754eaa2fd7696f98441bc783781d8656065cddfae3dbf503e"

	# https://www.openrce.org/repositories/users/RolfRolles/ExportHashesToIDC.py
	import pefile
	import sys
	import os

	# Convenience functions
	def rol32(val, amt):
	return ( (val << amt) & 0xffffffff ) \| ( ( val >> (32 - amt) ) & 0xffffffff )

	def ror32(val, amt):

	# avoid 'error: can't combine user with prefix, exec_prefix/home, or install_(plat)base'
	# https://stackoverflow.com/questions/4495120/combine-user-with-prefix-error-with-setup-py-install/4495175#4495175
	python setup.py install --user --prefix=

	git remote add upstream $1
	git fetch upstream
	git merge upstream/master