lslogins command within Linux

The lslogins command returns details for user accounts.  The command will display information on all accounts including service accounts by default.  To only view user accounts, use the -u switch.

To view details for a particular user account, use the user name.

Use the switch -uf to view failed logins.

Use the -ua switch to view password expiration details.

Convert to CSV web site

The following web site offers several options to convert data to and from the .CSV format.

http://convertcsv.com/

Duf

Duf is a disk usage utility.  It is available for multiple platforms.

https://github.com/muesli/duf

https://www.howtogeek.com/modern-cli-tools-that-have-replaced-ps-df-and-curl-for-me/

https://www.both.org/?p=10326

Text File Splitter

Text File Splitter is a free Windows utility that allows you to split a large text or log file into multiple, smaller files.

http://textfilesplitter.org/

ZMap

ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

https://github.com/zmap/zmap

INetSim

INetSim is a software suite for simulating common internet services in a lab environment.

https://www.inetsim.org/

CodeSandbox

 CodeSandbox is an online coding environment that has a free trier.

https://codesandbox.io/

Recover an object from Active Directory Recycle Bin

To recover an object or user account that was deleted from Active Directory (if the AD Recycle Bin has been enabled), use the command below to view the contents of the items that have been deleted.

Get-ADObject -filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' -includeDeletedObjects

Found the object in question and make note of the GUID parameter.

Deleted           : True

DistinguishedName : CN=Test Account\0ADEL:a769525b-0ac1-40c6-9cb5-9cdd8d221435

                    ,CN=Deleted Objects,DC=test,DC=local

Name              : Test Account

                    DEL:a769525b-0ac1-40c6-9cb5-9cdd8d221435

ObjectClass       : user

ObjectGUID        : a769525b-0ac1-40c6-9cb5-9cdd8d221435

Use the command below with the GUID value.

Restore-ADObject -Identity 'a769525b-0ac1-40c6-9cb5-9cdd8d221435'

https://stealthbits.com/blog/active-directory-object-recovery-recycle-bin/

Command line option to open the old System control panel app within Windows 10

With Windows 10 version 20H2 in the fall of 2020, Microsoft removed access to the old System app within the Control Panel.  One method to view the old app is to execute the following command:

explorer.exe shell:::{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}

Sysmon template files and resources

Below are links to a few different resources for Sysmon template files.

https://github.com/SwiftOnSecurity/sysmon-config

https://github.com/olafhartong/sysmon-modular

https://github.com/f8al/sysmon-config

https://github.com/randomuserid/Tylium/blob/master/Windows/sysmon-att%26ck.xml

https://github.com/wubbaroo/sysmon/blob/master/sysmon_config.xml

https://github.com/Neo23x0/sysmon-config

Below is a link to a guide for Sysmon.

https://github.com/trustedsec/SysmonCommunityGuide/releases

Below are the links to the deployment of Sysmon.

https://github.com/jokezone/Update-Sysmon

https://www.syspanda.com/index.php/2017/02/28/deploying-sysmon-through-gpo/

Below is a resource for the log entries that are created.

https://www.blackhillsinfosec.com/a-sysmon-event-id-breakdown/

Below is a cheat sheet page.

https://github.com/olafhartong/sysmon-cheatsheet

Newer versions can block certain file types.

https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-can-now-block-malicious-exes-from-being-created/