erickmendonca
/ tunnel.applescript
Created
July 16, 2018 04:06
Connect to VPN on Tunnelblick (macOS) with time-generated password
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -- connect to VPN on Tunnelblick with timegen password | |
| tell application "/Applications/Tunnelblick.app" | |
| set oauthpass to do shell script "oathtool --base32 YOUR_SECRET_HERE --totp" | |
| connect "CONFIG_NAME" | |
| delay 0.5 | |
| tell application "System Events" to keystroke oauthpass | |
| tell application "System Events" to keystroke return | |
| end tell |
mgeeky
/ sep-directory-exclusion.reg
Last active
February 21, 2023 18:42
Symantec Endpoint Protection directory exclusion registry key. According to M-Trends 2018, one of techniques used to overcome active AV scanning is to create a directory for files drop and to add it into AV's exclusion via registry.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Windows Registry Editor Version 5.00 | |
| [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Symantec\Symantec Endpoint Protection\AV\Exclusions\ScanningEngines\Directory\Client\1733004144] | |
| "Owner"=dword:00000004 | |
| "ProtectionTechnology"=dword:00000001 | |
| "FirstAction"=dword:00000011 | |
| "SecondAction"=dword:00000011 | |
| "DirectoryName"="C:\\to\\be\\excluded\\" | |
| "ThreatName"="C:\\to\\be\\excluded\\" | |
| "ExcludeSubDirs"=dword:00000001 |