robert-moses

NOTE - this was specifically built for a docker instance, with the Filebeat docker module collecting the logs.

robert-moses

# .bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi

# User specific environment and startup programs

set TERM=xterm-256color

robert-moses

# Well Known SIDs of interest
# SID: S-1-5-32-544
# Name: Administrators
#
# SID: S-1-5-21domain-512
# Name: Domain Admins
#
# Test lockout - EventID: 4740
(1..6)| %{ runas /user:DQGSOCAS4681\test1 cmd}

robert-moses

#
#
# To Do:
# Switch to either another variable for user profiles (all) or to simply sort through the c:\users\ folder.
#
#
#Delete Internet Explorer Cache
Remove-Item -path "$env:USERPROFILE\AppData\Local\Microsoft\Windows\Temporary Internet Files\*" -Recurse -Force -EA SilentlyContinue -Verbose
Remove-Item -path "$env:USERPROFILE\AppData\Local\Microsoft\Windows\INetCache\*" -Recurse -Force -EA SilentlyContinue -Verbose
Write-Host -ForegroundColor yellow "Internet Explorer Cache Removal - COMPLETE"

robert-moses

docker run -ti --rm --mount src=kali-root,dst=/root --mount src=kali-postgres,dst=/var/lib/postgresql my-kali
#
# Notes to setup/run a persistent kali docker container (my notes to setup on my usual windows work PC)
# credit to @Airman604
# https://medium.com/@airman604/kali-linux-in-a-docker-container-5a06311624eb
# https://hub.docker.com/r/kalilinux/kali-linux-docker/
# https://www.kali.org/news/official-kali-linux-docker-images/
# https://hub.docker.com/?ref=login&overlay=onboarding
# Setup Docker Desktop for Windows
# Requires Windows10 Pro and Hyper-V

robert-moses

O365 security baseline and incident response

Basics and Tools

Email Incident Response steps

---

Basics

https://docs.microsoft.com/en-us/office365/securitycompliance/office365-security-incident-response-overview

robert-moses

# scan and get all output file formats
nmap –sT –oA Network_Topology –vv 192.168.0.0/24
#
# pull the "alive" host IPs from the output
grep open Network_Topology.gnmap | cut -d" " -f2 > Device_List.txt
#
# rescan, to ensure nothing was missed with the -A option
nmap -A --excludefile Device_List.txt 192.168.0.0/24
#
# add additional hosts to list file, manually

robert-moses

#!/bin/bash
# Quick System Check Script
# Author: Robert Moses
## Logging setup
> quick_system_check.log
exec > >(tee -a quick_system_check.log)
exec 2> >(tee -a quick_system_check.log >&2)
#Set Date
MYDAY=`date +%d`
#Set Hour

robert-moses

# export protectors
manage-bde -protectors -get c:


#
# export key to a file
#
manage-bde -protectors -get c: >>  c:\temp\%COMPUTERNAME%-recovery-key.txt

robert-moses

# Replace path with the path you want, include file name pattern/etc
# Replace time/age with what you want
# add this as a schedule task.
Get-ChildItem C:\Inetpub\logs* -Include u_ex*.log -Recurse | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)} | Remove-Item