visuve

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import sys


if __name__ == "__main__":

    word = sys.argv[1]
    size = len(word)

visuve

using System.IO.Ports;
using System.Management;

class PicoDeploy
{
    private static void Main(string[] args)
    {
        if (args.Length == 0)
        {
            Console.WriteLine("Usage:");

visuve

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\Defender]
@="Scan File with Windows Defender"
"Icon"="C:\\Program Files\\Windows Defender\\MpDlpCmd.exe,0"

[HKEY_CLASSES_ROOT\*\shell\Defender\command]
@="cmd.exe /k \"\"C:\\Program Files\\Windows Defender\\MpCmdRun.exe\" -Scan -ScanType 3 -File \"%1\"\""

visuve

#include <iostream>
#include <algorithm>
#include <array>

template <typename T>
constexpr T swap_endian(T value)
{
	union
	{
		T value;

visuve

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

""" roulette.py - dare to play?"""
__author__ = "visuve"
__credits__ = ["visuve"]
__license__ = "0BSD"

import ctypes
import os

visuve

1. Configure Security Onion firewall

• Allow Filebeat agent input to Logstash

2. Install Filebeat agent in an end-user machine

• E.g. sudo apt install ./filebeat-7.15.0-amd64.deb
• NOTE: this should already exist in the "Downloads" directory

3. Configure Filebeat in /etc/filebeat/filebeat.yml

• Configure the output.logstash section
• Configure the filebeat.inputs section where the type is filestream
  • Add only /home/ite/f-secure.log path in it
• Remove all else!

visuve

0. Introduction

• In this tutorial a grok parser is built for F-Secure (Windows) products which use "fs_ccf_log" logger component

1. Open Grok debugger & familiarize with the Grok syntax

• https://grokdebug.herokuapp.com/
• Copy-paste the following lines into the "input" section:

2021-09-07 22:06:42.377 [2a88.23e0] D: main: Debug-viesti

visuve

"""
2021-09-07 22:06:42.377 [2a88.23e0]  D: main: Debug-viesti
2021-09-07 22:06:42.377 [2a88.23e0]  I: main: Informatiivinen viesti
2021-09-07 22:06:42.377 [2a88.23e0] .W: main: Varoitusviesti
2021-09-07 22:06:42.377 [2a88.23e0] *E: main: Virheviesti
"""

from datetime import datetime
import os
import random

visuve

1. Configure glances

• https://glances.readthedocs.io

1.1 Install glances

• apt install glances

1.2 Start glances on boot

• Remove old initd startup config
  • rm /etc/init.d/glances
• Create new systemd config

visuve

#include <cstdio>
#include <utility>

template <typename T, size_t N>
constexpr void Reverse(T (&str)[N])
{
    constexpr size_t len = N - 2;

    for (size_t i = 0, j = len; i <= j; ++i, --j)
        std::swap(str[i], str[j]);