invokethreatguy

function Get-CodeIntegrityEvent {
<#
.SYNOPSIS

Returns code integrity event log audit/enforcement events in a more human-readable fashion.

.DESCRIPTION

Get-CodeIntegrityEvent retrieves and parses Microsoft-Windows-CodeIntegrity/Operational PE audit and enforcement events into a format that is more human-readable. This function is designed to facilitate regular code integrity policy baselining.

invokethreatguy

from scapy.all import *
import time

ip = IP(dst='192.168.1.1', src='192.168.1.1')
udp = UDP(sport=1234,dport=1234)
payload = '\x01\x0f'

packet = ip/udp/payload

while(True):

invokethreatguy

$DevGuard = Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard
if ($DevGuard.SecurityServicesConfigured -contains 1) {"Credential Guard configured"}
if ($DevGuard.SecurityServicesRunning -contains 1) {"Credential Guard running"}
 

invokethreatguy

// The most up to date version is available 
// on GitHub: https://github.com/meziantou/Meziantou.Framework/tree/master/src/Meziantou.Framework.Win32.CredentialManager
// NuGet package: https://www.nuget.org/packages/Meziantou.Framework.Win32.CredentialManager/

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Runtime.InteropServices;
using System.Text;
using Microsoft.Win32.SafeHandles;

invokethreatguy

public class Output
{
    private readonly string  LogDirPath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "logs");

    private static Output _outputSingleton;
    private static Output OutputSingleton
    {
        get
        {
            if (_outputSingleton == null)

invokethreatguy

import time
import etw
import etw.evntrace
import sys
import argparse
import threading


class RundownDotNetETW(etw.ETW):
    def __init__(self, verbose, high_risk_only):

invokethreatguy

/*
using System;
using System.Runtime.InteropServices;
using System.Threading;
*/

/// <summary>
/// <para>
/// Sources: 
/// <para>https://stackoverflow.com/questions/358700/how-to-install-a-windows-service-programmatically-in-c </para>

invokethreatguy

$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if (-Not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  Write-Warning "We don't have elevated privileges. The following results may not be complete."
}
schtasks /query /fo csv -v | ConvertFrom-Csv | ? {$_.Status -notlike "Disabled" -and $_.TaskName -notlike "\Microsoft\Windows\*" -and $_.TaskName -notlike "\Microsoft\Office\*" -and $_.TaskName -notlike "\Microsoft\XblGameSave\*" -and $_.TaskName -notlike "TaskName" -and ($_."Run As User" -like "*system" -or  $_."Run As User" -like "Administrator*")} | fl taskname,"Comment","Task To Run","Run As User"

invokethreatguy

using System;
using System.Collections.Generic;
using System.EnterpriseServices;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.ConstrainedExecution;
using System.Runtime.InteropServices;
using System.Security.Permissions;
using System.Text;
using System.Threading;

invokethreatguy

#!/usr/bin/env python
from __future__ import print_function
import os
import subprocess
import threading
import json

# ProcessMonitor need to download from https://objective-see.com/products/utilities.html 
# and put to /Applications/ folder
# also give Terminal.app Full Disk Access