| // Version 8.6 - 4:06PM EST 7/21/24 | |
| // Get ConfigStateUpdate and SensorHeartbeat events | |
| #event_simpleName=/^(ConfigStateUpdate|SensorHeartbeat)$/ event_platform=Win | |
| | cid=?cid | |
| // Splitting aid list for large customers | |
| | regex(field=aid, regex=?aidsubset) | |
| // Parse ConfigStateUpdate and extract Channel File 291 version number; accept all SensorHeartbeat events and rename timestamp field |
| // Get ConfigStateUpdate and SensorHeartbeat events | |
| #event_simpleName=/^(ConfigStateUpdate|SensorHeartbeat)$/ event_platform=Win | |
| // Narrow search to Channel File 291 and extract version number; accept all SensorHeartbeat events within impact window | |
| | case{ | |
| #event_simpleName=ConfigStateUpdate | regex("\|1,123,(?<CFVersion>.*?)\|", field=ConfigStateData, strict=false) | parseInt(CFVersion, radix=16); | |
| #event_simpleName=SensorHeartbeat | rename([[@timestamp, LastSeen]]); | |
| } | |
| | case{ |
| Aaron.Aguilar | |
| Aaron.Alonso | |
| Aaron.alvarez | |
| Aaron.Arias | |
| Aaron.Benitez | |
| Aaron.Blanco | |
| Aaron.Blesa | |
| Aaron.Bravo | |
| Aaron.Caballero | |
| Aaron.Cabrera |
Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.
No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.
Prerequisites:
| #! /bin/bash | |
| # Pedro Gabaldon Julia 2021 | |
| # https://petergabaldon.github.io/ | |
| ### COLORS | |
| NOCOLOR='\033[0m' | |
| RED='\033[0;31m' | |
| GREEN='\033[0;32m' | |
| ORANGE='\033[0;33m' |
| /* | |
| * Based on Obdev's AVRUSB code and under the same license. | |
| * | |
| * TODO: Make a proper file header. :-) | |
| * Modified for Digispark by Digistump | |
| */ | |
| //Modified for spanish keyboard layout | |
| #ifndef __DigiKeyboard_h__ |
| #include <avr/pgmspace.h> | |
| // Lookup table to convert ascii characters in to keyboard scan codes | |
| // Format: most signifficant bit indicates if scan code should be sent with shift modifier | |
| // remaining 7 bits are to be used as scan code number. | |
| //Modified for spanish keyboard layout | |
| const unsigned char ascii_to_scan_code_table[] PROGMEM = { | |
| // /* ASCII: 0 */ 0, | |
| // /* ASCII: 1 */ 0, |