lawndoc

 <#

.SYNOPSIS
    Script to create a new Dev Drive

.DESCRIPTION
    This script will create a new Dev Drive on a Windows system. By default, it will create a 100GB dynamically sized VHDX file located in C:\ProgramData\Custom Dev Drive\drive.vhdx that will be mounted to the V: letter drive. For more information about Dev Drives, please see https://learn.microsoft.com/en-us/windows/dev-drive/

.EXAMPLE
    .\New-DevDrive.ps1

lawndoc

#!/usr/bin/env python3

import argparse
import grequests
import random
import requests
import string
import sys
from urllib.request import urlopen

lawndoc

Overview

Internet connection and DNS routing are broken from WSL2 instances, when some VPNs are active. The workaround breaks down into two problems:

1. Network connection to internet
2. DNS in WSL2

This problem is tracked in multiple microsoft/WSL issues including, but not limited to:

• microsoft/WSL#5068

lawndoc

// Advanced Hunting custom function
// ------------------------------------
// DeviceUsers()
// This function enriches a table with the users who use each device including full name, email, job title, etc.
// Example usage:
// ...
// | invoke DeviceUsers()
// ------------------------------------
let DeviceUsers = (T:(DeviceName:string)) {
    T

lawndoc

// credit to mRr3b00t @UK_Daniel_Card for the idea and starting point
// Globally Rare Service Installation
// Matches service executables to their file info and looks at global prevalence
let PrevalenceThreshold = 1000; // adjust as needed
DeviceEvents
| where ActionType == "ServiceInstalled"
| where FileName != ""  // Defender not capturing service executable sometimes -- needs investigation
//-- false positives
| where not (
    (FileName startswith "svchost.exe -k "  // lots of these

lawndoc

#!/usr/bin/env bash

# Author: C.J. May @lawndoc
# Usage: cloc-gh <username>
# Prereqs: cloc gh

cloc_repo () {
  gh repo clone "$1" temp-linecount-repo -- --depth 1 > /dev/null 2>&1 &&
  cloc temp-linecount-repo | grep SUM | awk '{ print $5 }' >> line_count.txt &&
  rm -rf temp-linecount-repo

lawndoc

DeviceProcessEvents
| where FileName =~ "PAD.MachineRegistration.Silent.exe"

lawndoc

#change permissions and delete shadows
$checkPermissions = icacls c:\Windows\System32\config\sam
if ($checkPermissions -like '*BUILTIN\Users:(I)(RX*)*') {
    icacls c:\windows\system32\config\*.* /inheritance:e
    vssadmin delete shadows /quiet /all
    $vulnerable = $true
}
else {
    $vulnerable = $false
}

lawndoc

### Global Variables (edit these)
$DOMAIN = "DC=example,DC=com"
$CSVPATH = ".\\"

### Begin Script
$windowsXP = [System.Collections.ArrayList]@()
$windows7 = [System.Collections.ArrayList]@()
$windows10 = [System.Collections.ArrayList]@()
$server03 = [System.Collections.ArrayList]@()
$server08 = [System.Collections.ArrayList]@()