Skip to content

Instantly share code, notes, and snippets.

View SyeedHasan's full-sized avatar
🖥️
Let's get it!

Hasan SyeedHasan

🖥️
Let's get it!
View GitHub Profile
<style>
body {
margin: 0;
width: 100%;
height: 100%
}
body,
td,
input,
@SyeedHasan
SyeedHasan / equation_laser.yar
Last active April 6, 2020 16:38
Yara rule for Equation Group's Equation Laser
// Module Imports
import "pe"
import "elf" // Though this won't be used since we're investigating a WIN32 executable
//import "magic"
// Only applicable to *UNIX systems since it relies on 'file'
// Module Imports
import "pe"
@SyeedHasan
SyeedHasan / npm_issues.txt
Last active September 8, 2020 07:41
NPM Configuration Issues
1. CB() never called; execute the command with sudo privileges (sudo npm ...) otherwise sudo npm cache verify
2. After package installations or removals, remove the cache for the first startup; (expo start -c)
3. To remove NPM packages; npm uninstall <package>
1) UnicodeDecodeError: Specify the encoding used to write the file while reading the file e.g. encoding="utf-8"
2) Pretty-print and save the JSON data using:
```
import json
with open('data.json', 'w', encoding='utf-8') as f:
json.dump(data, f, ensure_ascii=False, indent=4)
```
@SyeedHasan
SyeedHasan / parseml.py
Created November 11, 2020 17:05 — forked from urschrei/parseml.py
Extract attachments from EML files in the current dir, and write them to the output subdir
#!/usr/bin/env python
"""
2020 update:
- More iterators, fewer lists
- Python 3 compatible
- Processes files in parallel
(one thread per CPU, but that's not really how it works)
"""
@SyeedHasan
SyeedHasan / mount-problems.md
Last active May 18, 2021 17:13
Mounting Shared Folders
@SyeedHasan
SyeedHasan / elk-ip-corruption.md
Last active May 24, 2021 06:37
ELK - Importing Saved Objects

Importing Dashboards in ELK

  1. Visit 'Stack Management'
  2. Head to 'Saved Objects'
  3. Import the NDJSON file for the objects/dashboard you wish to add
  4. Confirm the import

'Requested Entity Too Large' During Imports

Max upload size is restricted in Kibana or a reverse proxy (if you have any). Head to Kibana's configuration and increase the 'maxPayloadSize' key to a larger value. Similarly, if you use Nginx, add the following line to your configuration file to increase the max body size:

@SyeedHasan
SyeedHasan / Winlogbeat Configuration.md
Last active May 29, 2021 17:28
Winlogbeat tweaks

Winlogbeat Custom Template Naming

Steps

  1. Update the 'index' field in output.elasticsearch [e.g. win-host-%{yyyy-mm-dd}]
  2. Update the 'setup.template.name' and 'setup.template.pattern' accordingly [e.g., win- and win-*]
  3. Disable ILM because custom template naming won't work if this is enabled i.e., setup.ilm.enabled: false
  4. Load the custom template: .\winlogbeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["192.168.18.110:1337"]'
  5. Restart the winlogbeat service
@SyeedHasan
SyeedHasan / Github Flavored Markdown.md
Last active October 5, 2021 09:36 — forked from stevenyap/Github Flavored Markdown.md
Github Flavored Markdown cheatsheet

Github Flavored Markdown (GFMD) is based on Markdown Syntax Guide with some overwriting as described at Github Flavored Markdown

Text Writing

It is easy to write in GFMD. Just write simply like text and use the below simple "tagging" to mark the text and you are good to go!

To specify a paragraph, leave 2 spaces at the end of the line

Headings

1. To increase inotify watches on Watchman, run:
echo 999999 | sudo tee -a /proc/sys/fs/inotify/max_user_watches && echo 999999 | sudo tee -a /proc/sys/fs/inotify/max_queued_events && echo 999999 | sudo tee -a /proc/sys/fs/inotify/max_user_instances && watchman shutdown-server
2. If a watchman crawl fails, run:
watchman shutdown-server; WATCHMAN_CONFIG_FILE=~/watchman watchman --foreground --logfile=/dev/stdout --no-save-state --statefile=/dev/null