Couldn't find the text of this for a while...
Picking the right architecture = Picking the right battles + Managing trade-offs
- Clarify and agree on the scope of the system
- User cases (description of sequences of events that, taken together, lead to a system doing something useful)
- Who is going to use it?
- How are they going to use it?
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
redis: | |
image: redis | |
sentry-celery-beat: | |
environment: | |
SENTRY_SECRET_KEY: 'thisisnotsosecret' | |
command: | |
- sentry | |
- celery | |
- beat | |
image: sentry |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"queries": [{ | |
"name": "List all owned users", | |
"queryList": [{ | |
"final": true, | |
"query": "MATCH (m:User) WHERE m.owned=TRUE RETURN m" | |
}] | |
}, | |
{ | |
"name": "List all owned computers", |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# This script assumes Responder is in /opt/Responder | |
# Error messages begone! | |
exec 2>/dev/null | |
# Hardcoded location for script output files | |
OUTDIR=${HOME}'/working/loot/gathered' | |
# Hardcoded location for ntlmrelayx's .sam file output directory | |
NTLMRELAY=${HOME}'/working/loot/ntlmrelay' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#pragma once | |
#include <stdint.h> | |
#include <stdio.h> | |
namespace be | |
{ | |
void print_message( const char* msg ) | |
{ | |
printf( "[BATTLEYE] %s\n", msg ); | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sequence by host.hostname with maxspan=1m | |
[network where network.direction : ("egress", "outgoing") and | |
process.name != "spoolsv.exe" and not network.protocol == "dns" and not user.name : "SYSTEM" and | |
source.port >= 49152 and destination.port >= 49152] by destination.address,source.address, destination.port, source.port | |
[network where process.name : "spoolsv.exe" and user.name : "SYSTEM" and | |
network.direction : ("ingress", "incoming") and | |
not network.protocol == "dns" and | |
source.port >= 49152 and destination.port >= 49152] by source.address, destination.address, destination.port, source.port |