truekonrads

try:
    import ujson as json
except ImportError:
    import json
import aiohttp, asyncio
import logging

logging.basicConfig(
    format="{'time':'%(asctime)s', 'name': '%(name)s', \
    'level': '%(levelname)s', 'message': '%(message)s'}"

truekonrads

from pyaff4 import data_store
from pyaff4 import aff4_image
from pyaff4 import lexicon
from pyaff4 import rdfvalue
from pyaff4 import zip
import urllib.parse

def getAff4Images(filepath):
    volume_path_urn = rdfvalue.URN.NewURNFromFilename(filepath)
    resolver = data_store.MemoryDataStore()

truekonrads

#!/usr/bin/env python3
# To add a new cell, type '# %%'
# To add a new markdown cell, type '# %% [markdown]'
# %%
from datetime import datetime
from multiprocessing import Pool
from lxml import etree
from lxml.etree import XMLSyntaxError
import logging
import sys

truekonrads

#!/usr/bin/env python

import urllib.parse
try:
    import ujson as json
except ImportError:
    import json
import datetime
import sys
import re

truekonrads

import pefile
import pprint

pe = pefile.PE(r"D:\Training\AdditionalDLLs\Security\MsAuditE.dll")


for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
    if entry.id == 11:
        actual_data = entry.directory.entries[0].directory.entries[0].data
        size = actual_data.struct.Size

truekonrads

How to update ElasticSearch fields

Suppose you have a field which you have ingested as "text", but it is actually an IP address (sometimes). You would like to treat it as an IP address, but can't or won't re-create the index. Then do this:

$ curl -XPUT 'http://localhost:9200/myindex/logs/_mapping
{
  
        "properties": {
 "Network Information Network Address": {

truekonrads

#!/usr/bin/env python
# Convert evtx to json
import Evtx.Evtx as evtx
import sys
import json


def recursive_dict(element):
    # https://stackoverflow.com/questions/42925074/python-lxml-etree-element-to-json-or-dict
    t = element.tag

truekonrads

#!/usr/bin/env  python 
import pyshark
import sys
cap=pyshark.FileCapture(sys.argv[1])
targetstream=sys.argv[2]

for p in cap:
    if "http2" in p:
        i=0
        for s in p.http2.stream.all_fields:

truekonrads

#  Copyright (c) 2014-present, Facebook, Inc.
#  All rights reserved.
#
#  This source code is licensed under the BSD-style license found in the
#  LICENSE file in the root directory of this source tree. An additional grant
#  of patent rights can be found in the PATENTS file in the same directory.

param(
  [string] $args = "",
  [switch] $install = $false,

truekonrads

#!/bin/sh

showmount -e $1|perl -wne 'chomp; $root=$1 if m!Export list for ([^:]+):!; if (defined($root) and m!^(/.+?)\s+(\*|\([^)]+\))$!){ $dir="/mnt/nfs/$root/$1"; print "mkdir -p \"$dir\"\n";print "mount -o vers=3,nolock \"$root:$1\" \"$dir\"\n";}'|sh