RomelSan

#-------------------------------------------------------------------------------------
# Create Self signed root certificate
# -dnsname -DnsName domain.example.com,anothersubdomain.example.com
# -Subject "CN=Patti Fuller,OU=UserAccounts,DC=corp,DC=contoso,DC=com" 
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=P2SRootCert" `
-KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 4096 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-KeyUsageProperty Sign `

RomelSan

Set up Powerline in PowerShell

PowerShell prerequisites

Install Windows Terminal: https://github.com/microsoft/terminal/releases
Install Git for Windows: https://git-scm.com/downloads
Install Cascadia Code PL Font: https://github.com/microsoft/cascadia-code/releases

Using PowerShell, install Posh-Git and Oh-My-Posh:

• Oh-My-Posh provides theme capabilities for your PowerShell prompt.
• Posh-Git adds Git status information to your prompt as well as tab-completion for Git

RomelSan

<NotepadPlus>
    <UserLang name="RouterOS" ext="rsc" udlVersion="2.1">
        <Settings>
            <Global caseIgnored="yes" allowFoldOfComments="no" foldCompact="no" forcePureLC="0" decimalSeparator="0" />
            <Prefix Keywords1="no" Keywords2="no" Keywords3="yes" Keywords4="no" Keywords5="no" Keywords6="no" Keywords7="no" Keywords8="no" />
        </Settings>
        <KeywordLists>
            <Keywords name="Comments">00# 01 02 03 04</Keywords>
            <Keywords name="Numbers, prefix1"></Keywords>
            <Keywords name="Numbers, prefix2"></Keywords>

RomelSan

# Incident Response: Windows Cheatsheet
# Commands for CMD / Powershell / GUI

# Check user accounts
lusrmgr.msc
  # See the user accounts for the system and the type of account it is
net user
Get-LocalUser
# Check Administrators
net localgroup administrators

RomelSan

First things to do with a Raspberry Pi 4 (Raspbian Lite)

Initial Changes

• Change User Password
• Change Hostname
• Enable SSH
• Change Time-Zone
  sudo timedatectl
• Memory Spit
  sudo raspi-config

RomelSan

# List privileged services that don't come with Windows 10 

# Exclusion List for Win10 built in
$exclusion = @('AppVClient', 'ClickToRunSvc', 'COMSysApp', 'diagnosticshub.standardcollector.service',
           'msiserver', 'ose', 'perceptionsimulation', 'SecurityHealthService', 'Sense',
           'SensorDataService', 'SgrmBroker', 'Spooler', 'ssh-agent', 'TieringEngineService',
           'TrustedInstaller', 'UevAgentService', 'vds', 'VSS', 'wbengine', 'WinDefend', 'wmiApSrv',
            'WSearch', 'SamSs')
            
# Get Service List with LocalSystem and Startmode Auto and does not contain svchost.exe (Also exclude the ones from the list)

RomelSan

Eject USB Units

Find the culprit that prevents ejection of Flash Drives or any other unit.

CMD

wevtutil qe System /q:"*[System[(EventID=225)]]" /c:5 /f:text /rd:true

RomelSan

Kitty portable recommended settings

1. Terminal --> Features --> Disable Application Keypad mode
2. Terminal --> Keyboard --> The Function keys and keypad --> Linux
3. Connection --> Data --> set terminal-type string to linux
4. Window -> Appearance set check for "Allow selection of variable pitch fonts"
5. Window -> Colours set check for "Selected text is a different colour"
6. Use font Cascadia Code PL included with "Windows Terminal" app or download from github
   File to install: CascadiaCodePL.ttf
   https://github.com/microsoft/cascadia-code
7. If you are using oh my zsh then you can use the fonts from nerdfonts.com

RomelSan

* start the SSH service with systemctl

sudo systemctl enable ssh
sudo systemctl start ssh
sudo systemctl restart sshd

* Allow Or Deny SSH Access To A Particular User Or Group In Linux
sudo nano /etc/ssh/sshd_config

* Add or edit the following line:

RomelSan

# Minimum size of USB stick 6GB

# Set here the path of your ISO file
$iso = 'C:\Users\localuser\Downloads\en_win10.iso'

# Clean ! will clear any plugged-in USB stick!!
Get-Disk | Where BusType -eq 'USB' | 
Clear-Disk -RemoveData -Confirm:$true -PassThru

# Convert GPT