wzr

Skeptics Guide to Security Conferences

Anonymous - Script kiddies. Also see: Slacktivism
Advanced - More advanced than the products the presenter sells
APT - "Fancy name for shit you have in your network and didn't notice for a while"
China - Because why not? Also see: Attribution Dice

This is a collection of snippets, not a comprehensive guide. I suggest you start with Operational PGP.

Here is an incomplete list of things that are different from other approaches:

	#TODO: Create exclude args for platforms

	download-splunk() {

	# Where to store the platform and forwarder packages
	local SPLUNK_BIN_DIR=/srv/splunk-platform
	local SPLUNK_UF_DIR=/srv/splunk-uf
	[[ -d ${SPLUNK_BIN_DIR} ]] \|\| mkdir -p ${SPLUNK_BIN_DIR}
	[[ -d ${SPLUNK_UF_DIR} ]] \|\| mkdir -p ${SPLUNK_UF_DIR}

	# Author: Matthew Graeber (@mattifestation)

	$Epoch = Get-Date '01/01/1970'

	# Conversion trick taken from https://blogs.technet.microsoft.com/heyscriptingguy/2017/02/01/powertip-convert-from-utc-to-my-local-time-zone/
	$StrCurrentTimeZone = (Get-WmiObject Win32_timezone).StandardName
	$TZ = [TimeZoneInfo]::FindSystemTimeZoneById($StrCurrentTimeZone)

	# Parse out all the LogonGUID fields for sysmon ProcessCreate events
	Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Sysmon/Operational'; Id = 1 } \| ForEach-Object {

	[WinEventLog:Security]
	#Returns most of the space savings XML would provide
	SEDCMD-clean0-null_sids = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(\:)(\s+NULL SID)$/\1/g s/(?m)(ID\:)(\s+0x0)$/\1/g
	SEDCMD-clean1-summary = s/This event is generated[\S\s\r\n]+$//g
	SEDCMD-clean2-cert_summary = s/Certificate information is only[\S\s\r\n]+$//g
	SEDCMD-clean3-blank_ipv6 = s/::ffff://g
	SEDCMD-clean4-token_elevation_summary = s/Token Elevation Type indicates[\S\s\r\n]+$//g
	SEDCMD-clean5-network_share_summary = s/(?ms)(A network share object was checked to see whether.*$)//g
	SEDCMD-clean6-authentication_summary = s/(?ms)(The computer attempted to validate the credentials.*$)//g
	SEDCMD-clean7-local_ipv6 = s/(?ms)(::1)//g

	'''
	IDAPython script that generates a YARA rule to match against the
	basic blocks of the current function. It masks out relocation bytes
	and ignores jump instructions (given that we're already trying to
	match compiler-specific bytes, this is of arguable benefit).

	If python-yara is installed, the IDAPython script also validates that
	the generated rule matches at least one segment in the current file.

	author: Willi Ballenthin <william.ballenthin@fireeye.com>

	'''
	IDAPython script that generates a YARA rule to match against the
	basic blocks of the current function. It masks out relocation bytes
	and ignores jump instructions (given that we're already trying to
	match compiler-specific bytes, this is of arguable benefit).

	If python-yara is installed, the IDAPython script also validates that
	the generated rule matches at least one segment in the current file.

	author: Willi Ballenthin <william.ballenthin@fireeye.com>

	#!/usr/bin/env python3
	"""
	Description
	"""
	from argparse import ArgumentParser
	import logging
	import os
	import sys

	from somewhere import main