mgreen27

LET find_flows(clientid,artifact) = SELECT *
    FROM flatten(query={ SELECT client_id, session_id,artifacts_with_results,start_time,state FROM flows(client_id=clientid) })
    WHERE artifacts_with_results = artifact
    LIMIT 1 -- will collect latest
   

LET results = SELECT
    client_id as ClientId,
    os_info.hostname as Hostname,
    os_info.fqdn as Fqdn,

mgreen27

name: Windows.System.MsiInstallerMetadata
author: Matt Green - @mgreen27
description: |
  This artifact allows runs VBScript through cscript.exe and calculates MSI 
  installer metadata.
  
  Not using powershell to minimise footprint, use notebook to search for metadata.
  
required_permissions:
  - EXECVE

mgreen27

# This is a staging file for Running TCGLogTools in Velociraptor

Import-Module $Env:TCGLogTools

$TCGLog = ls $Env:TCGLogLocation | ConvertTo-TCGEventLog -MinimizedX509CertInfo
$TCGCurrentBytes = Get-TCGLogContent -LogType SRTMCurrent
$TCGLog = $TCGLog + $(ConvertTo-TCGEventLog -LogBytes $TCGCurrentBytes -MinimizedX509CertInfo)
$TCGLog | ConvertTo-Json -Depth 8

mgreen27

Function Patch-RDP {
    <#
    .SYNOPSIS
        Patch RDP to enable multiple RDP sessions on non RDP servers.

        Name: patch_rdp.ps1
        Version: 0.2
        Author: Matt Green - @mgreen27

    .DESCRIPTION

mgreen27

#!/bin/bash
# Update install script
# run ./update.sh velociraptor-v0.6.4-dev-linux-amd64

# firslt backup old installer
#mv *.deb old/

# next make binary executable
sudo chmod +x $1

mgreen27

function Get-InjectedThreadEx
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION
    

mgreen27

/*
### Drive Ransom note stats
*/
SELECT
    strip(string=split(string=OSPath,sep=':')[0],prefix='''\\.\''') as Drive,
    FileName as RansomeNote,
    --min(item=Created0x10) as EarliestCreation,
    --max(item=Created0x10) as LatestCreation,
    min(item=LastModified0x10) as EarliestModified,
    max(item=LastModified0x10) as LatestModified,

mgreen27

### NTFS exercise setup

## 1. download some files to test various content and add ADS to simulate manual download from a browser

$downloads = (
    "https://live.sysinternals.com/PsExec64.exe",
    "https://live.sysinternals.com/procdump64.exe",
    "https://live.sysinternals.com/sdelete64.exe"
)

mgreen27

-- add API key here
LET APIKey = 'REDACTED'

-- firstly Materialize all entries for performance
LET all_entries <= SELECT 
            Fqdn,ClientId,
            `Entry Location` as EntryLocation,
            Entry,Enabled,Profile,Description,Company,
            `Image Path` as ImagePath,
            Version,

mgreen27

## Plaso stuff

# log2timeline
docker run -v $(pwd):/data log2timeline/plaso log2timeline /data/$MACHINENAME.plaso /data/$MACHINENAME

# parsers can be targeted or skipped with --parsers command
docker run -v $(pwd):/data log2timeline/plaso log2timeline --parsers=\!filestat,\!mft,\!usnjrnl /data/$MACHINENAME.plaso /data/$MACHINENAME 
docker run -v $(pwd):/data log2timeline/plaso log2timeline --parsers=winevtx /data/$MACHINENAME_evtx.plaso /data/$MACHINENAME