zaneGittins

package main

import (
	"bufio"
	"encoding/json"
	"fmt"
	"log"
	"os"
	"os/exec"
	"path/filepath"

zaneGittins

#include <stdio.h>
#include <Windows.h>
#include <winternl.h>
#include "winternl.h"
#pragma comment(lib, "ntdll")

/* based on: https://github.com/nothydud/direct-syscall/blob/master/main.c
			 https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet/blob/main/evasion/direct_syscall.cpp
			 
*/

zaneGittins

#!/usr/bin/env bash
# chainsaw2timesketch.sh
# author: zane gittins
# updated: 11/1/2022
# tested on chainsaw version: v2.2.0

# Get all evtx files in the current directory.
for file in *.evtx; do

    # Ensure that file exists.

zaneGittins

#!/usr/bin/env python2
# Author: Zane Gittins
# Small tool to assist in parsing hexdumps and optionally writing to binary file.

import re
import sys
import binascii
import argparse

def extract_hex(file_path):

zaneGittins

File created:
RuleName: DLL
UtcTime: 2021-06-30 17:17:08.957
ProcessGuid: {9ca9a477-a70f-60dc-856d-f00000000000}
ProcessId: 332
Image: C:\Windows\System32\spoolsv.exe
TargetFilename: C:\Windows\System32\spool\drivers\x64\3\New\Test.dll
CreationUtcTime: 2021-06-30 17:14:41.231

Network connection detected:

zaneGittins

# Check SMB Signing
function Get-SMBSigningStatus {
    [CmdletBinding()]
    $SMBSigning = (Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\LanManWorkstation\Parameters" -Name RequireSecuritySignature).RequireSecuritySignature
    $Results = @()

    if($SMBSigning -eq 1) {
        return $true
    } else {
        return $false

zaneGittins

Exchange 0days

Resources

• Microsoft Blog
• Microsoft Safety Scanner
• Microsoft Detection Scripts
• Volexity Blog
• Blue Team Labs
• Thor Scanner

zaneGittins

# GetEventLogReport
# This is a modified version of the script provided by IBM-Security, this version also estimates EPS of Sysmon.
# Credits - IBM Security (Jamie Wheaton // William Delong)
function Get-EventLogInfo { param($Agent, $LogName, $RemoteComputer, $OS)

    $LogInfo = @{}        

     try {     
                          
        # Just localhost

zaneGittins

# NTMonitor
# Author: Zane Gittins
# Modified version of code by Matt Hand, all credit goes to Matt Hand for original script.
# Blog post by Matt Hand here: https://posts.specterops.io/adventures-in-dynamic-evasion-1fe0bac57aa
# Takes executable as arg.
# Monitors NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory.

import frida
import sys
import argparse

zaneGittins

input {
   file {
      path => [
         "/var/log/osquery/result.log"
      ]
   }
}
filter {
  json {
    source => "message"