Skip to content

Instantly share code, notes, and snippets.

View neu5ron's full-sized avatar

Nate Guagenti neu5ron

119 followers · 27 following
View GitHub Profile
@neu5ron
neu5ron / dynamic-dns.txt
Last active September 10, 2022 10:08
This list has moved to the repo https://github.com/neu5ron/dynamic_dns_lists
3d-game.com #dtdns.com
4irc.com #dtdns.com
b0ne.com #dtdns.com
bbsindex.com #dtdns.com
chatnook.com #dtdns.com
darktech.org #dtdns.com
deaftone.com #dtdns.com
dtdns.net #dtdns.com
effers.com #dtdns.com
etowns.net #dtdns.com
@neu5ron
neu5ron / valid_domain_name_regex
Last active July 2, 2023 10:40
Valid domain name regex including internationalized domain name
domain_regex = r'(([\da-zA-Z])([_\w-]{,62})\.){,127}(([\da-zA-Z])[_\w-]{,61})?([\da-zA-Z]\.((xn\-\-[a-zA-Z\d]+)|([a-zA-Z\d]{2,})))'
#Python
domain_regex = '{0}$'.format(domain_regex)
valid_domain_name_regex = re.compile(domain_regex, re.IGNORECASE)
self.domain_name = self.domain_name.lower().strip().encode('ascii')
if re.match(valid_domain_name_regex, self.domain_name ):
return True
else:
return False
@neu5ron
neu5ron / dynamic-dns-providers
Last active May 18, 2024 11:55
This list has moved to the repo https://github.com/neu5ron/dynamic_dns_lists
dynu.com
dyn.com
no-ip.com
noip.com
changeip.com
afraid.org
duckdns.org
dnsdynamic.org
duiadns.net
myonlineportal.com
@neu5ron
neu5ron / keybase.md
Created October 14, 2016 17:41

Keybase proof

I hereby claim:

  • I am neu5ron on github.
  • I am neu5ron (https://keybase.io/neu5ron) on keybase.
  • I have a public key whose fingerprint is 6A0E 02A4 E191 1C10 DAB4 F257 C2E9 3D96 A895 5C05

To claim this, I am signing this object:

@neu5ron
neu5ron / nxlog-cuckoo-to-logstash.conf
Last active February 1, 2018 23:26
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension _json>
@neu5ron
neu5ron / DNSCrypt Ubuntu;OpenDNS Crypt
Last active January 8, 2017 20:06
sudo apt-get -y install build-essential checkinstall automake libtool pkg-config;
wget -O libsodium.tar.gz https://download.libsodium.org/libsodium/releases/LATEST.tar.gz
mkdir libsodium && tar -zxvf libsodium.tar.gz -C libsodium --strip-components=1;
cd libsodium;
chmod +x configure && sh ./configure;
make;
sudo make install;
sudo ldconfig;
cd ../;
wget -O dnscrypt.tar.gz https://download.dnscrypt.org/dnscrypt-proxy/LATEST.tar.gz;
@neu5ron
neu5ron / 511-windows-event-powershell-operational.conf
Last active August 13, 2018 18:50
Windows PowerShell Logstash Parser. Parses EventID's 4103 and 4104. Hash Script Block Text ---- useful for finding reoccuring scripts we want to whitelist/blacklist. Hash Script Block Text and UserID ---- because sometimes certain accounts should not run certain scripts, so filtering just by hash could be a problem.
filter {
if [@meta][log][type] == "windows-wef" {
# PowerShell Operational Only
if [Channel] == "Microsoft-Windows-PowerShell/Operational" {
# EventID 4103
if [EventID] == 4103 {
@neu5ron
neu5ron / example 4663 wef subscription for canary files
Created January 4, 2018 07:23
https://nathanguagenti.blogspot.com/2018/01/canary-files-for-legit-access-abuse-with-wef-and-elk.html
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='ObjectName'] and (Data='C:\Users\Public\Documents\new-login-information.txt')]]
and
*[System[(EventID='4663')]]
</Select>
</Query>
</QueryList>
@neu5ron
neu5ron / nxlog-config-for-wef-server.conf
Created January 4, 2018 07:31
https://nathanguagenti.blogspot.com/2018/01/canary-files-for-legit-access-abuse-with-wef-and-elk.html
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension _json>
@neu5ron
neu5ron / additional_http_headers-main.bro
Last active January 9, 2019 11:18
Add Additional HTTP Header fields to Bro http logs
module HTTP;
# Add additional HTTP Headers
redef record Info += {
#Origin "Origin"
origin: string &log &optional;
};
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=5