Skip to content

Instantly share code, notes, and snippets.

View ion-storm's full-sized avatar

ionstorm ion-storm

226 followers · 172 following
View GitHub Profile
@ion-storm
ion-storm / Invoke-WMISMB.ps1
Created April 17, 2019 00:10 — forked from rvrsh3ll/Invoke-WMISMB.ps1
function Invoke-SMBWmi {
[CmdletBinding()]
param(
[String[]]
$ComputerName = ".",
[String]
$Pipename = "tf12lol"
@ion-storm
ion-storm / Get-InjectedThread.ps1
Created February 19, 2019 13:44 — forked from olafhartong/Get-InjectedThread.ps1
Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone
function Get-InjectedThread
{
<#
.SYNOPSIS
Looks for threads that were created as a result of code injection.
.DESCRIPTION
@ion-storm
ion-storm / openvas-automate.sh
Created February 14, 2019 15:45 — forked from mgeeky/openvas-automate.sh
OpenVAS automation script.
#!/bin/bash
#
# OpenVAS automation script.
# Mariusz B. / mgeeky, '17
# v0.2
#
trap ctrl_c INT
# --- CONFIGURATION ---
@ion-storm
ion-storm / SetupCustomGraylogMappings.md
Created January 5, 2019 01:20 — forked from thomasdarimont/SetupCustomGraylogMappings.md
Add custom mappings to graylog (elasticsearch) for additional parameters (_MessageParam0...N) added by GELF Logger

Create custom mappings

cat << EOF > graylog-custom-mapping.json
{
  "template": "graylog_*",
  "mappings" : {
    "message" : {
      "properties" : {
        "MessageParam0" : {
          "type" : "string",
@ion-storm
ion-storm / EDR_Killer.ps1
Created December 17, 2018 16:29 — forked from mgreen27/EDR_Killer.ps1
WMI EventConsumer to disable EDR (or other tools) tools when installed
# PowerShell 2.0
# Name: EDR_Killer.ps1
# Version: 1.0
# Author: @mgreen27
# Description: Powershell WMI Event Consumer Proof of Concept to disable EDR tools when installed.
# Original Template (Eventlog Consumer) attributed to @mattifestation: https://gist.github.com/mattifestation/aff0cb8bf66c7f6ef44a
# Set Variables
$Name = 'EDR_Killer'
$Query = 'SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA "Win32_Service" AND (TargetInstance.Name = "Sysmon" OR TargetInstance.Name = "Service name 2" OR TargetInstance.Name = "Service Name ..." OR TargetInstance.Name = "Service name N")'
@ion-storm
ion-storm / RuleLangAceMod.js
Created December 6, 2018 03:16 — forked from thomasdarimont/RuleLangAceMod.js
PoC for custom Highlighting for the RuleLang of the Graylog Pipeline Plugin
define(function(require, exports, module) {
"use strict";
var oop = require("../lib/oop");
var TextHighlightRules = require("./text_highlight_rules").TextHighlightRules;
var DocCommentHighlightRules = require("./doc_comment_highlight_rules").DocCommentHighlightRules;
var identifierRe = "[a-zA-Z\\$_\u00a1-\uffff][a-zA-Z\\d\\$_\u00a1-\uffff]*";
var GraylogRuleLangHighlightRules = function() {
@ion-storm
ion-storm / kafka installation and systemd
Created November 27, 2018 22:22 — forked from vipmax/kafka install systemd.md
cd /opt
wget http://apache-mirror.rbc.ru/pub/apache/kafka/0.10.1.0/kafka_2.11-0.10.1.0.tgz
tar xvzf kafka_2.11-0.10.1.0.tgz
ln -s kafka_2.11-0.10.1.0/ kafka
vi /etc/systemd/system/kafka-zookeeper.service
[Unit]
Description=Apache Zookeeper server (Kafka)
Documentation=http://zookeeper.apache.org
@ion-storm
ion-storm / windows_hardening.cmd
Created November 4, 2018 02:26 — forked from mackwage/windows_hardening.cmd
Script to perform some hardening of Windows OS
::
::#######################################################################
::
:: Change file associations to protect against common ransomware attacks
:: Note that if you legitimately use these extensions, like .bat, you will now need to execute them manually from cmd or powershell
:: Alternatively, you can right-click on them and hit 'Run as Administrator' but ensure it's a script you want to run :)
:: ---------------------
ftype htafile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
ftype WSHFile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
ftype batfile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
@ion-storm
ion-storm / FreeNAS.md
Created October 7, 2018 02:52 — forked from MikeRatcliffe/FreeNAS.md
Ultimate FreeNAS Setup
@ion-storm
ion-storm / CrowdStrike Savedsearches.conf
Created August 21, 2018 16:34 — forked from MHaggis/CrowdStrike Savedsearches.conf
[POWERSHELL-DOWNLOAD-HUNT]
dispatch.earliest_time = -24h@h
dispatch.latest_time = now
dispatchAs = user
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
display.visualizations.charting.chart = bar
display.visualizations.show = 0
search = FileName=powershell.exe (CommandLine=*DownloadFile* OR CommandLine=*invoke-webrequest*) | stats values(CommandLine) as "commands" by ComputerName