Skip to content

Instantly share code, notes, and snippets.

View samsplunks's full-sized avatar

Sam Splunks samsplunks

View GitHub Profile
@samsplunks
samsplunks / wordle.md
Created February 2, 2022 08:01 — forked from huytd/wordle.md
Wordle in less than 50 lines of Bash

image

How to use:

./wordle.sh

Or try the unlimit mode:

@samsplunks
samsplunks / elasticsearch.md
Created November 18, 2021 13:40 — forked from nicolashery/elasticsearch.md
Elasticsearch: updating the mappings and settings of an existing index

Elasticsearch: updating the mappings and settings of an existing index

Note: This was written using elasticsearch 0.9.

Elasticsearch will automatically create an index (with basic settings and mappings) for you if you post a first document:

$ curl -X POST 'http://localhost:9200/thegame/weapons/1' -d \
'{
  "_id": 1,
@samsplunks
samsplunks / Get-WinEventData and Sysmon.ps1
Created August 26, 2021 14:11 — forked from RamblingCookieMonster/Get-WinEventData and Sysmon.ps1
Extract detailed data from Sysmon event logs
# Download and dot source Get-WinEventData
# https://gallery.technet.microsoft.com/scriptcenter/Get-WinEventData-Extract-344ad840
. "\\path\to\Get-WinEventData.ps1"
# Download and Set up Sysmon as desired
# http://technet.microsoft.com/en-us/sysinternals/dn798348
# http://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon
#Use Get-WinEvent and Get-WinEventData to obtain events and extract XML data from them - let's see all the properties behind one!
Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=3} |
@samsplunks
samsplunks / SysmonCheck.ps1
Created August 26, 2021 14:11 — forked from psrdrgz/SysmonCheck.ps1
PowerShell functions for parsing Sysmon event logs
using namespace System.Management.Automation
function Search-SysmonCommandline
{
[CmdletBinding(DefaultParameterSetName='InProcess')]
Param(
[Parameter(Mandatory = $True)]
[string[]]$CommandLine,
[Parameter(Mandatory = $False)]
@samsplunks
samsplunks / Create-Administrator.ps1
Created June 3, 2021 08:12 — forked from ducas/Create-Administrator.ps1
Create a local administrator account using PowerShell
$Username = "su"
$Password = "password"
$group = "Administrators"
$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$existing = $adsi.Children | where {$_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }
if ($existing -eq $null) {
@samsplunks
samsplunks / Dockerfile
Created May 26, 2021 13:17 — forked from bdenning/Dockerfile
Dockerfile for creating Splunk container
FROM docker.io/centos:latest
MAINTAINER Bowen Denning <bdenning@gmail.com>
ENV PATH=$PATH:/opt/splunk/bin
RUN yum update -y
## Download and install Splunk
RUN curl https://download.splunk.com/products/splunk/releases/6.4.1/linux/splunk-6.4.1-debde650d26e-linux-2.6-x86_64.rpm -O && \
yum install -y splunk*.rpm && \
@samsplunks
samsplunks / xorg.conf
Created May 22, 2021 13:34 — forked from ArrEssJay/xorg.conf
xorg.conf for 4 NVIDIA GTX1080i GPU, fake monitor, headless arrangement
# Use this in a situation where you want a headless Linux box with multiple GPU boards but no desktop environment
# Fake EDID convinces drivers that a monitor is connected
# Use any EDID binary file
# To start a fake X server make a systemd file with something like:
# ExecStart=/usr/bin/tcsh -c 'xinit /opt/set-gpu-fans/setfanspeed.sh -- :0 -once -config /opt/set-gpu-fans/xorg.rob'
# See other gist for fan setting script : https://gist.github.com/RobDeBagel/a960c2b157256c162220e60300529cf0
Section "ServerLayout"
Identifier "Layout0"
# generate via: wevtutil gp Microsoft-Windows-Sysmon /getevents /getmessage
name: Microsoft-Windows-Sysmon
guid: 5770385f-c22a-43e0-bf4c-06f5698ffbd9
helpLink:
resourceFileName: C:\Windows\Sysmon.exe
messageFileName: C:\Windows\Sysmon.exe
message:
channels:
channel: