Sam's Information

Friday, February 9, 2018

SPF Policy Tester

The link below offers a free SPF Policy tester.

https://vamsoft.com/support/tools/spf-policy-tester

PSSysmonTools

PSSysmonTools are some PowerShell tools for Sysmon.

https://github.com/mattifestation/PSSysmonTools

PowerShell NetEventPacketCapture

PowerShell has an option available to capture network traffic. To view the list of available provider parameters, use the following command:

logman query providers

The Select-String cmdlet can be used to search within the list.

logman query providers | select-string smb

https://blogs.technet.microsoft.com/networking/2017/12/12/wnv-deep-dive-part-3-capturing-and-reading-virtualized-network-traffic/

https://docs.microsoft.com/en-us/powershell/module/neteventpacketcapture/?view=win10-ps

https://4sysops.com/archives/capture-network-traces-with-the-powershell-module-neteventpacketcapture/

https://blogs.technet.microsoft.com/heyscriptingguy/2015/10/12/packet-sniffing-with-powershell-getting-started/

Monday, January 1, 2018

Set Up Automatic Restore Points within Windows 10

To set up automatic restore points within Windows 10, search with the text of “system restore.” Click on the Configure button and verify that the feature is enabled.

With Windows 10 Pro, launch the local Group Policy editor (gpedit.msc) and access the following path:

Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus –> Scan

Enable the “Create a system restore point” option.

http://www.itprotoday.com/windows-10/how-set-automatic-restore-points-windows-10

ASLR Registry setting with Windows

Windows 8 and later has a change in how system-wide mandatory ASLR is implemented. This change requires system-wide bottom-up ASLR to be enabled for mandatory ASLR to receive entropy.

To enable both bottom-up ASLR and mandatory ASLR on a system-wide basis on a Windows 8 or later machine, the following registry value should be imported:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]
"MitigationOptions"=hex:00,01,01,00,00,00,00,00,00,00,00,00,00,00,00,00

https://blogs.technet.microsoft.com/srd/2017/11/21/clarifying-the-behavior-of-mandatory-aslr/

http://www.kb.cert.org/vuls/id/817544

osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive.

osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.

https://osquery.io/

Rescatux

Rescatux is a Debian-based GNU/Linux live distribution that includes a graphical wizard for rescuing broken GNU/Linux installations. The available rescue options include restoring the GRUB bootloader after a Windows installation, Linux and Windows password resets, and Linux file system checks.

https://www.supergrubdisk.org/rescatux/

Detection Lab

Detection Lab is a collection of Packer and Vagrant scripts that allow you to quickly bring a Windows Active Directory online, complete with a collection of endpoint security tooling and logging best practices.

https://isc.sans.edu/forums/diary/Detection+Lab+Visibility+Introspection+for+Defenders/23135/

https://github.com/clong/DetectionLab