0xtf

TLP:RED #FF2B2B
TLP:AMBER #ffc000
TLP:GREEN #33ff00
TLP:WHITE #ffffff

0xtf

Visualization (tcpdump, tshark)

tcpdump -qns 0 -X -r file.pcap
tcpdump -qns 0 -A -r file.pcap
tcpdump -X -r file.pcap
tshark -r file.pcap -V

Packet manipulation (tcprewrite)

Port: tcprewrite --portmap=OLDPORT:NEWPORT -i in.pcap -o out.pcap

0xdabbad00

a4b:AssociateContactWithAddressBook
a4b:AssociateDeviceWithRoom
a4b:AssociateSkillGroupWithRoom
a4b:CreateAddressBook
a4b:CreateContact
a4b:CreateProfile
a4b:CreateRoom
a4b:CreateSkillGroup
a4b:CreateUser
a4b:DeleteAddressBook

isalgueiro

#! /bin/bash

publicIP=`dig +short myip.opendns.com @resolver1.opendns.com`

securityGroupIds="sg-stuffstuff"
ruleDescription="This is the string we're using to find our rule"

## Consult previous one
awsOutput=`aws ec2 describe-security-groups --group-ids $securityGroupIds`
ipRangeIndex=`echo $awsOutput | gron | grep $ruleDescription | sed "s/.\+IpRanges\[\([0-9]\+\)\].\+/\1/"`

mpurzynski

alert tcp any any -> any !80 (msg:"SURICATA HTTP on unusual port"; flow:to_server; app-layer-protocol:http; threshold: type limit, track by_src, seconds 60, count 1; sid:2271001; rev:1;)
alert tcp any any -> any 80 (msg:"SURICATA non-HTTP on TCP port 80"; flow:to_server; app-layer-protocol:!http; threshold: type limit, track by_src, seconds 60, count 1; sid:2271002; rev:1;)

alert tcp any any -> any ![443,465,587] (msg:"SURICATA TLS on unusual port"; flow:to_server; app-layer-protocol:tls; threshold: type limit, track by_src, seconds 60, count 1; sid:2271004; rev:1;)
alert tcp any any -> any [443,465] (msg:"SURICATA non-TLS on TLS port"; flow:to_server; app-layer-protocol:!tls; threshold: type limit, track by_src, seconds 60, count 1; sid:2271003; rev:1;)

alert tcp any any -> any ![20,21] (msg:"SURICATA FTP on unusual TCP port"; flow:to_server; app-layer-protocol:ftp; threshold: type limit, track by_src, seconds 60, count 1; sid:2271005; rev:1;)
alert tcp any any -> any [20,21] (msg:"SURICATA non-FTP on TCP 

vulnersCom

#petya #petrWrap #notPetya

Win32/Diskcoder.Petya.C

Ransomware attack.

About

This gist was built by the community of the researchers and was scribed by Kir and Igor from the QIWI/Vulners. We are grateful for the help of all those who sent us the data, links and information. Together we can make this world a better place!

Gist updates

grugq

Operational PGP

This is a guide on how to email securely.

There are many guides on how to install and use PGP to encrypt email. This is not one of them. This is a guide on secure communication using email with PGP encryption. If you are not familiar with PGP, please read another guide first. If you are comfortable using PGP to encrypt and decrypt emails, this guide will raise your security to the next level.