by Proofpoint
by Austin Hudson
Florian Roth Neo23x0
Neo23x0
/ nighthawk-blog-posts.md
Last active
August 12, 2026 06:51
Collection of Deleted Articles on MDSec's Nighthawk
Neo23x0
/ log4j_rce_detection.md
Last active
August 5, 2026 08:38
Log4j RCE CVE-2021-44228 Exploitation Detection
You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
Neo23x0
/ annotations.xml
Last active
May 20, 2026 22:17
Sources for APT Groups and Operations Search Engine
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?xml version="1.0" encoding="UTF-8"?> | |
| <Annotations start="0" num="171" total="171"> | |
| <Annotation about="www.bussink.net/*" timestamp="0x0005d7bc4022b026" href="ChF3d3cuYnVzc2luay5uZXQvKhCm4IqBxPf1Ag"> | |
| <Label name="_cse_turlh5vi4xc"/> | |
| <AdditionalData attribute="original_url" value="https://www.bussink.net/"/> | |
| </Annotation> | |
| <Annotation about="*.thedfirreport.com/*" timestamp="0x0005d76dd5f8679d" href="ChUqLnRoZWRmaXJyZXBvcnQuY29tLyoQnc_hr93t9QI"> | |
| <Label name="_cse_turlh5vi4xc"/> | |
| <AdditionalData attribute="original_url" value="https://thedfirreport.com/"/> | |
| </Annotation> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # IMPORTANT! | |
| # This gist has been transformed into a github repo | |
| # You can find the most recent version there: | |
| # https://github.com/Neo23x0/auditd | |
| # ___ ___ __ __ | |
| # / | __ ______/ (_) /_____/ / | |
| # / /| |/ / / / __ / / __/ __ / | |
| # / ___ / /_/ / /_/ / / /_/ /_/ / | |
| # /_/ |_\__,_/\__,_/_/\__/\__,_/ |
Neo23x0
/ Base64_CheatSheet.md
Last active
April 13, 2026 08:47
Learning Aid - Top Base64 Encodings Table
| Base64 Code | Mnemonic Aid | Decoded* | Description |
|---|---|---|---|
JAB |
🗣 Jabber | $. |
Variable declaration (UTF-16), e.g. JABlAG4AdgA for $env: |
TVq |
📺 Television | MZ |
MZ header |
SUVY |
🚙 SUV | IEX |
PowerShell Invoke Expression |
SQBFAF |
🐣 Squab favorite | I.E. |
PowerShell Invoke Expression (UTF-16) |
SQBuAH |
🐣 Squab uahhh | I.n. |
PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz |
PAA |
💪 "Pah!" | <. |
Often used by Emotet (UTF-16) |
Neo23x0
/ fortinet-domains.txt
Last active
April 6, 2026 16:03
FortiGate Dump Domains - Grouped by TLD and Sorted Alphabetically
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| This is a list of the domains used in the contact email addresses found in the Fortinet dump file as published by Belsen Group and analysed by Kevin Beaumont on Mastodon : https://cyberplace.social/@GossiTheDog/113834848200229959 | |
| Some of these domains may just be the domains of free email services or services providers working for the actual victims. | |
| AE | |
| ---------------------------------------------------------------------- | |
| acsllc.ae | |
| aisdubai.ae | |
| alhamra.ae | |
| alrayan.ae | |
| alshirawi.ae |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| https://thedfirreport.com/ | |
| https://www.zerodayinitiative.com/blog/ | |
| https://codewhitesec.blogspot.com/ | |
| https://www.digitalshadows.com/blog-and-research/ | |
| https://blog.talosintelligence.com/ | |
| https://www.riskiq.com/blog/ | |
| https://www.sekoia.io/en/blog-sekoia-io/ | |
| https://www.nextron-systems.com/blog/ | |
| https://www.microsoft.com/security/blog/ | |
| https://blog.truesec.com/ |
Neo23x0
/ minecraft-seus-shader.md
Last active
March 21, 2026 06:21
Minecraft with SEUS Shader - Guide
Guide by Florian Roth
https://www.minecraft.net/en-us/store/minecraft-java-edition/
Neo23x0
/ ollama-no-think-proxy.md
Created
January 30, 2026 00:13
A lightweight HTTP proxy that makes Ollama compatible with OpenAI-compatible clients while disabling "thinking" mode for faster responses and ensuring sufficient context window for tool-heavy requests.
If you're using Clawdbot with Ollama, this proxy solves three critical issues:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Windows triage collector (best-effort) - builds a ZIP with event logs and key system snapshots. | |
| .DESCRIPTION | |
| Collects a focused set of Windows artefacts to help debug "sometimes slow boot / input lag / occasional black screen" | |
| issues. Designed to never hang indefinitely: | |
| - Self-elevates to Administrator (UAC) if needed | |
| - Adds hard timeouts for external tools (msinfo32, dxdiag, wevtutil, robocopy) | |
| - Skips WER ReportQueue (often huge/locked and causes infinite runs) |
NewerOlder