Skip to content

Instantly share code, notes, and snippets.

View nasbench's full-sized avatar
📚

Nasreddine Bencherchali nasbench

📚
599 followers · 92 following
View GitHub Profile
@nasbench
nasbench / pwsh_dirty_words.yml
Last active April 23, 2026 14:26
List of suspicious strings used by PowerShell `SuspiciousContentChecker` function
# Source: System.Management.Automation.dll
# This list is used to determin if a ScriptBlock contains potential suspicious content
# If a match is found an automatic 4104 with a "warning" level is generated.
# https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/runtime/CompiledScriptBlock.cs
- "Add-Type"
- "AddSecurityPackage"
- "AdjustTokenPrivileges"
- "AllocHGlobal"
- "BindingFlags"
- "Bypass"
@nasbench
nasbench / README.md
Last active January 15, 2026 04:57
Malicious CHM Proof of Concept

Malicious CHM - Proof of Concept

Here are the steps to follow in order to create a malicious CHM file. As used by APT37

  • Download the HTML Help Workshop (Htmlhelp.exe) from MSDN. If the link is dead you can use the archive version here
  • Once installed you should have a folder C:\Program Files (x86)\HTML Help Workshop and inside the Microsoft HTML Help Compiler (hhc.exe)
  • We need to create 3 files:
    • Project File .hpp
    • HTML File .htm
  • Table of Contents File .hhc
@nasbench
nasbench / TLGMetadataParser.psm1
Created December 28, 2024 21:43 — forked from mattifestation/TLGMetadataParser.psm1
Retrieves TraceLogging metadata from a file.
#requires -version 5
<#
The things you find on Google searching for specific GUIDs...
Known Keyword friendly names:
"UTC:::CATEGORYDEFINITION.MS.CRITICALDATA":"140737488355328"
"UTC:::CATEGORYDEFINITION.MS.MEASURES":"70368744177664"
"UTC:::CATEGORYDEFINITION.MS.TELEMETRY":"35184372088832"
"UTC:::CATEGORYDEFINITION.MSWLAN.CRITICALDATA":"2147483648"
@nasbench
nasbench / system_profiler_data_types.md
Created January 2, 2024 10:52
Command Output: `system_profiler -listDataTypes`
  • SPAirPortDataType
  • SPApplicationsDataType
  • SPAudioDataType
  • SPBluetoothDataType
  • SPCameraDataType
  • SPCardReaderDataType
  • SPConfigurationProfileDataType
  • SPDeveloperToolsDataType
  • SPDiagnosticsDataType
  • SPDisabledSoftwareDataType
@nasbench
nasbench / ATPSiPolicy.xml
Created September 12, 2023 19:58 — forked from mgraeber-rc/ATPSiPolicy.xml
Recovered Microsoft Defender for Endpoint WDAC policy that is dropped to %windir%\System32\CodeIntegrity\ATPSiPolicy.p7b when "Restrict App Execution" is enabled for a device.
<?xml version="1.0"?>
<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy">
<VersionEx>10.0.0.0</VersionEx>
<PolicyTypeID>{4E61C68C-97F6-430B-9CD7-9B1004706770}</PolicyTypeID>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<Rules>
<Rule>
<Option>Enabled:UMCI</Option>
</Rule>
<Rule>
@nasbench
nasbench / RMM-detection.md
Created May 7, 2023 13:07 — forked from brokensound77/RMM-detection.md
Detection Engineering: RMM analysis

Detecting RMM

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

  • if the software is not used in the envrionment
    • could it be legitimate by a random empoyee?
    • is it an attacker BYOL
    • even so, all occurrences could probably be considered suspicious
  • if it is used in the environment
    • is every use of it legitimate? Probably not
  • this also creates significant living off the land (LOL) opportunity
@nasbench
nasbench / shellBigInt.cs
Created May 6, 2023 22:43 — forked from djhohnstein/shellBigInt.cs
Shellcode Stuffed in BigInteger
sing System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
@nasbench
nasbench / howto.txt
Created May 5, 2023 10:07 — forked from andrewkroh/howto.txt
Microsoft-Windows-Windows Defender Event Log Message Resources
800, AntiVirus
801, AntiSpyware
802, Antimalware
803, Full
804, Delta
805, Full Scan
806, Quick Scan
807, Custom Scan
808, Remove
809, Quarantine
@nasbench
nasbench / README.md
Created April 14, 2023 14:09
Executing Commands in an Appx Context Via Invoke-CommandInDesktopPackage
@nasbench
nasbench / DumpMinitool.md
Created April 12, 2023 00:35
DumpMinitool LOLBIN

DumpMinitool.exe LOLBIN

This binary can be used as a LOLBIN as described here

Addtional Info

  • The arguments flags are meaningless only the order is important. This means as long as you provide exactly 6 flags and their value the binary will still work. Here are the exact positions for reference:
// Usage: --file <fullyResolvedPath> --processId <processId> --dumpType <dumpType>