Micah Babinski mbabinski
mbabinski
/ WebDAVAnalysis.py
Created
July 31, 2023 22:42
A simple Python script which I used to scan suspicious webdav servers, looking for recently-updated malicious files to research.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # WebDAVAnalysis.py | |
| from webdav3.client import Client | |
| domains = ['dhqidee98lja03f52atdmii.webdav.drivehq.com', | |
| 'dhqidcr68ljmwke8780y3bg.webdav.drivehq.com', | |
| 'kpm.webdav.drivehq.com', | |
| 'dhqidv8g20pwi1uxkdlojyb.webdav.drivehq.com', | |
| 'dhqid9pjapv63d8xvji8g4s.webdav.drivehq.com', | |
| 'dhqidaxs78nhjtsucbk0eg2.webdav.drivehq.com', | |
| 'dhqidfvyxawy0du9akl2ium.webdav.drivehq.com', |
mbabinski
/ InvestigationClosure.py
Created
May 24, 2023 19:45
Demonstration tool showing how to bulk close investigations in the Rapid7 Insight IDR platform using InsightIDR4Py. Created for the Medium post "Button-Pusher to MasterBuilder: Automating SIEM Workflows."
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import InsightIDR4Py as idr | |
| import argparse | |
| import sys | |
| # collect user choices | |
| parser = argparse.ArgumentParser(description="Closes investigations in bulk depending on user selections.", | |
| epilog='Example usage: `python InvestigationClosure.py --assignee-email \ | |
| swilliams@acme.com --days-since-last-access 30 --source ALERT --disposition BENIGN`') | |
| parser.add_argument("-p", "--priority", | |
| dest="priority", |