Cyb3r-Monk / better_event_logging.ps1

Created March 2, 2025 06:56 — forked from ecapuano/better_event_logging.ps1

A PowerShell script for installing Sysmon and enabling best-practice audit logs.

	# ================================================
	# Sysmon & Windows Event Log Configuration Script
	# ================================================

	# Check for administrative privileges
	$currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
	$principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
	if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
	Write-Host "This script requires administrative privileges. Please run as an administrator." -ForegroundColor Red
	exit 1

Cyb3r-Monk / atexec_rpc.py

Created November 28, 2024 08:27 — forked from ThePirateWhoSmellsOfSunflowers/atexec_rpc.py

	#!/usr/bin/env python
	# Impacket - Collection of Python classes for working with network protocols.
	#
	# Copyright Fortra, LLC and its affiliated companies
	#
	# All rights reserved.
	#
	# This software is provided under a slightly modified version
	# of the Apache Software License. See the accompanying LICENSE file
	# for more information.

Cyb3r-Monk / GraphPlotly.kql

Created February 28, 2024 17:07 — forked from cosh/GraphPlotly.kql

A stored function that uses the evaluate python operator to execute a Python script that uses the plotly, networkx and pandas libraries to create a plotly viz object from the input tables. The function also adds some styling and annotations to the graph object, such as colors, sizes, hover texts, etc. It uses the replace_string function to inser…

	.create-or-alter function with (skipvalidation = "true") VisualizeGraphPlotly(
	E:(sourceId:long,targetId:long), N:(nodeId:long),
	pLayout:string="spring_layout", pColorscale:string="Picnic", pTitle:string="Happy kraphing!") {
	let pythonCodeBlueprint = ```
	import numpy as np
	import pandas as pd
	import plotly.graph_objects as go
	import networkx as nx

	G = nx.Graph()

Cyb3r-Monk / bin2c.py

Created October 29, 2022 20:28 — forked from OtterHacker/bin2c.py

	"""
	Transform a binary file into a C header file.
	The binary file is splitted into 16 char strings and rebuild at execution time.

	The function buildsc() must be called in your main to rebuild the binary file into the sc C variable.
	The length is set in the sc_length variable.

	Be carefull, try to avoid compiler code optimization as it will remove all these modifications in the final binary.
	"""

Cyb3r-Monk / ExportOffice365user.ps1

Created October 18, 2022 15:07 — forked from CCOSTAN/ExportOffice365user.ps1

Powershell commands for export Azure AD and import into local AD

	#import office 365 session
	$UserCredential = Get-Credential
	$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
	Import-PSSession $Session

	#connect Azure AD
	Connect-MsolService -Credential $UserCredential

	#Random password generator
	Function random-password ($length = 8)

Cyb3r-Monk / modern_sql_style_guide.md

Created September 1, 2022 12:00 — forked from mattmc3/modern_sql_style_guide.md

Modern SQL Style Guide

layout	default
author	mattmc3
title	Modern SQL Style Guide
revision	2019-01-17
version	1.0.1
description	A guide to writing clean, clear, and consistent SQL.

Modern SQL Style Guide

Cyb3r-Monk / zipfs_law_threat_hunting.py

Created August 30, 2022 11:52 — forked from dtrizna/zipfs_law_threat_hunting.py

	from datetime import datetime, timedelta
	from os import path
	import sqlite3
	import time
	import json

	# ===================
	# DATABASE OPERATIONS
	# ===================
	def sqlite_instantiate(dbconfig, table="hashes"):

Cyb3r-Monk / KerberosCorrelation.ipynb

Created July 18, 2022 13:55 — forked from jonny-jhnson/KerberosCorrelation.ipynb

Kerberos Detection/Investigation

Sorry, something went wrong. Reload?

Sorry, we cannot display this file.

Sorry, this file is invalid so it cannot be displayed.

Cyb3r-Monk / log-forwarding-with-etw.ps1

Created June 9, 2021 14:56 — forked from ajpc500/log-forwarding-with-etw.ps1

Quick-and-dirty PowerShell script to install Sysmon (SwiftOnSecurity config), SilkService and Winlogbeat, and forward logs to HELK based on IP set in environment variable "HELK_IP" (see Line 233).

	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
	$wc = New-Object System.Net.WebClient

	if (!(Test-Path "C:\Tools")) {
	New-Item -Path "C:\" -Name "Tools" -ItemType "directory"
	}

	# SYSMON
	# Download Sysmon
	$SysmonDirectory = "C:\Tools\Sysmon\"

Cyb3r-Monk / folder-structure.md

Created June 3, 2021 16:46 — forked from ryanflorence/folder-structure.md

Folder Structure

Please note

While this gist has been shared and followed for years, I regret not giving more background. It was originally a gist for the engineering org I was in, not a "general suggestion" for any React app.

Typically I avoid folders altogether. Heck, I even avoid new files. If I can build an app with one 2000 line file I will. New files and folders are a pain.

Mehmet E. Cyb3r-Monk

Modern SQL Style Guide

Folder Structure

Please note