Skip to content

Instantly share code, notes, and snippets.

@josehelps
josehelps / gpt_custom_instructions.txt
Last active March 26, 2024 01:23
GPT custom instructions
Write in a normal tone, but professional. dont' use words that an AI detector would catch
Try to mimic my writing style and tone as much as possible in results. Do not add fluff to text when possible be as clear and direct as nice and casual. Also, try to be as human as possible in responses, answer in a a professional but clear and direct terms. Optimize for clarity and concise messaging.
When I ask for code, give me the simplest form of an answer with the least amount of external libraries, and also focus on efficiency. Also just give me the code no need for an explanation, or a very short explanation if needed. Write efficient, readable code that includes clear, concise comments
When asking a factual question please always provide citations and your confidence. If you do not know please state you do not know. Also please DO NOT add an extensive explanation of how you are a AI assistant.
When providing readme or code, always reply in a format that is easy to copy and paste like markdown when possible.
@josehelps
josehelps / check_detection_urls.py
Created September 3, 2023 19:03
checks lolbas detections for correctness
import os
import argparse
import requests
import yaml
import csv
def check_url(url):
try:
response = requests.get(url)
return response.status_code
@josehelps
josehelps / loldriver_lql_gen.py
Created August 14, 2023 23:39
generates lql policy from loldriver malicious hashes
import requests
import textwrap
def fetch_hashes(url):
response = requests.get(url)
if response.status_code != 200:
print("Error fetching data.")
return None
return response.text.strip().split("\n")
@josehelps
josehelps / zenbleed.yaml
Created July 27, 2023 20:22
Zenbleed LQL
{
source {
LW_HE_MACHINES
}
filter {
contains(CPU_INFO, 'vendor_id')
and contains(CPU_INFO, 'AuthenticAMD')
and contains(CPU_INFO, 'model name')
and NOT contains(TAGS, 'GCP')
and NOT contains(TAGS, 'AWS')
@josehelps
josehelps / lacework-k8s.yaml
Created April 4, 2023 13:52
lacework agent k8s
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: lacework-agent
labels:
tier: monitoring
app: lacework-agent
spec:
selector:
@josehelps
josehelps / lacework-cfg-k8s.yaml
Created April 4, 2023 13:50
lacework daemonset config default
apiVersion: v1
kind: ConfigMap
metadata:
name: lacework-config
data:
config.json: |
{"tokens":{"AccessToken":"xxxx"}, "tags":{"Env":"k8s"}, "serverurl":"https://api.lacework.net"}
syscall_config.yaml: |
etype.exec:
group-by:
@josehelps
josehelps / transparent-puny.py
Created November 2, 2022 17:20
Python tool that starts listening for newly registered certificates writes down the entire certificate for the ones that have puny code on the SubjectAlternativeName field
import certstream
import argparse
import json
import re
def write_cert(message):
try:
with open(OUTPUT_PATH, 'a') as outfile:
json.dump(message, outfile)
except Exection as e:
@josehelps
josehelps / keybase.md
Created October 17, 2022 15:08
keybase.md

Keybase proof

I hereby claim:

  • I am josehelps on github.
  • I am joseehernandez (https://keybase.io/joseehernandez) on keybase.
  • I have a public key whose fingerprint is 8E9E 6A0B 7E3E 8766 E8D6 F3D3 A05D 53D2 AB89 CB20

To claim this, I am signing this object:

@josehelps
josehelps / dnstwist.py
Created May 3, 2022 18:14
splunk custom command: dnstwist
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
#
#
# Licensed under the Apache License, Version 2.0 (the "License"): you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
@josehelps
josehelps / prelude-operator.service
Last active May 2, 2022 01:28
Prelude Operator SystemD
# Expects Headless Operator binary under headless under: /opt/prelude
# Safe this file to /etc/systemd/system/prelude-operator.service, then run: systemctl daemon-reload
# You can configure a specific account by writing ACCOUNT_EMAIL var under /opt/prelude/env
# example:
# ACCOUNT_EMAIL=a8b6a79c-c98b-11ec-ba35-3f30ad1005c5@desktop.prelude.org
# Writes logs to syslog
[Unit]
Description=Prelude Operator