NeodymiumPhish NeodymiumPhish
ureddy-uptycs
/ osquery_yara_rule.sql
Created
December 13, 2021 03:11
A SQL query that can be run as a realtime query in osquery to detect if java processes running on a host have opened log files that contain the yara signature specified in the query. The yara rules are used to detect log4j vulnerability CVE-2021-44228
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| SELECT * | |
| FROM yara | |
| WHERE | |
| (path IN (SELECT path FROM process_open_files WHERE pid IN (SELECT pid FROM processes WHERE name = 'java') AND path LIKE '%.log' AND path NOT LIKE '%kafka%') | |
| OR path LIKE '/var/log/%%' ) | |
| AND ( | |
| rule = 'rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft { | |
| meta: | |
| description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228" | |
| author = "Florian Roth" |
jaredcatkinson
/ Get-InjectedThread.ps1
Last active
July 1, 2024 08:32
Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function Get-InjectedThread | |
| { | |
| <# | |
| .SYNOPSIS | |
| Looks for threads that were created as a result of code injection. | |
| .DESCRIPTION | |