Skip to content

Instantly share code, notes, and snippets.

@mmguero
mmguero / sample intel sources.md
Created April 12, 2024 13:34
sample Public STIX and MISP intel sources for testing Malcolm's Zeek Intelligence Framework integration

Zeek Intelligence Framework for Malcolm

  • /zeek/intel/MISP/.misp_input.txt
misp|https://www.circl.lu/doc/misp/feed-osint/manifest.json
misp|https://www.botvrij.eu/data/feed-osint/manifest.json
misp|https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/manifest.json
  • /zeek/intel/STIX/.stix_input.txt
@mmguero
mmguero / docker-compose.yml
Created April 8, 2024 13:27
samba-docker-compose.yml using slirp4netns with rootless podman
services:
samba:
image: docker.io/dperson/samba:latest
environment:
TZ: 'America/Denver'
USERID: 0
GROUPID: 0
ports:
- "0.0.0.0:137:137/udp"
- "0.0.0.0:138:138/udp"
@mmguero
mmguero / export.json
Created April 2, 2024 20:58
example of TSVB markdown table for downloading URL
{
"attributes": {
"description": "",
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"
},
"title": "markdown URL example",
"uiStateJSON": "{}",
"version": 1,
"visState": "{\"title\":\"markdown URL example\",\"type\":\"metrics\",\"aggs\":[],\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#54B399\",\"split_mode\":\"terms\",\"split_color_mode\":\"opensearchDashboards\",\"metrics\":[{\"size\":1,\"agg_with\":\"noop\",\"order\":\"desc\",\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"top_hit\",\"field\":\"zeek.files.extracted_uri\",\"order_by\":\"firstPacket\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"color_rules\":[{\"value\":0,\"id\":\"1f169c40-f12a-11ee-9364-f9bff3c7f983\"
@mmguero
mmguero / export.json
Created April 2, 2024 19:47
example of osd_transform table for OpenSearch Dashboards
{
"attributes": {
"description": "",
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"
},
"title": "Example table with transform",
"uiStateJSON": "{}",
"version": 1,
"visState": "{\"title\":\"Example table with transform\",\"type\":\"transform\",\"aggs\":[],\"params\":{\"meta\":\"({})\",\"multiquerydsl\":\"{\\n \\\"topn\\\": {\\n \\\"index\\\": \\\"zeekicata-*\\\",\\n \\\"query\\\": {\\n \\\"bool\\\": {\\n \\\"must\\\": [\\n \\\"_DASHBOARD_CONTEXT_\\\",\\n \\\"_TIME_RANGE_[firstPacket]\\\",\\n {\\n \\\"match\\\": {\\n \\\"event.dataset\\\": \\\"files\\\"\\n }\\n },\\n {\\n \\\"match\\\": {\\n \\\"event.provider\\\": \\\"zeek\\\"\\n }\\n }\\n ]\\n }\\n },\\n \\\"aggs\\\": {\\n \\\"uris\\\": {\\n \\\"terms\\\": {\\n \\\"field\\\": \\
@mmguero
mmguero / vboxmacos.md
Last active April 23, 2024 17:27
VirtualBox on macOS fixes

Make sure NSHighResolutionCapable in /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/Info.plisst is set to <false/> for a pretty difference in performance.

$ grep -i NSHigh /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/Info.plisst
    <key>NSHighResolutionCapable</key>          <true/>

Set it like this:

@mmguero
mmguero / release_cleaver.ps1
Created March 15, 2024 13:12
release_cleaver.ps1 for splitting and joining large files into 2GB chunks for GitHub releases
# release_cleaver.ps1
# Split and join large files into 2 gigabyte chunks. sha256 sum is
# also calculated and saved on split and checked on join.
$ErrorActionPreference = "Stop"
# Split a binary file into a series of smaller files
@mmguero
mmguero / release_cleaver.sh
Last active March 15, 2024 13:12
release_cleaver.sh for splitting and joining large files into 2GB chunks for GitHub releases
#!/usr/bin/env bash
# release_cleaver.sh
# Split and join large files into 2 gigabyte chunks. sha256 sum is
# also calculated and saved on split and checked on join.
if [ -z "$BASH_VERSION" ]; then
echo "Wrong interpreter, please run \"$0\" with bash"
exit 1
fi
@mmguero
mmguero / calibredb_set_metadata_using_find.sh
Created February 18, 2024 05:50
calibredb set_metadata using find
for ID in $(find . -type f -iname "*Vigilantes v*" | grep -Po "\d\d\d\d" | grep -v ^20); do \
for METADATA in 'authors:Hideyuki Furuhashi' 'series:My Hero Academia: Vigilantes'; do \
/app/calibre/bin/calibredb --library-path=/books set_metadata -f "$METADATA" "$ID"; \
done; \
done
@mmguero
mmguero / mp3join.sh
Created February 17, 2024 22:20
join a bunch of MP3 files (e.g., audiobooks) without reencoding
detox *.mp3 && \
rm -f mylist.txt &&\
for FILE in *.mp3; do \
echo "file '$FILE'" >> mylist.txt; \
done;
ffmpeg -f concat -safe 0 -i mylist.txt -vn -c:a copy ../"$(basename "$(pwd)").mp3"; \
rm -f mylist.txt
@mmguero
mmguero / wpa_supplicant.conf
Created February 16, 2024 14:04
wpa_supplicant.conf format
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=US
network={
ssid="Your network SSID"
psk="Your WPA/WPA2 security key"
key_mgmt=WPA-PSK
}