I have to start somewhere...

Here's some links for now:
This is a collection of my bashrc and related files. I've been daily-driving Linux terminals now for years and this is one of the first things I install. The screenshot below however is taken from one of my Windoze hosts.

If you work in CND/DFIR/CTI and you aren't familiar with LaikaBOSS, I recommend taking a look. It's a framework originally intended as an IDPS, but it's since grown to do far more than just those tasks. The core concept is that modern file-types tend to be tiered and follow an object-oriented design, so a modern IDS/IPS needed to be able to analyze these objects as such.
getrichlaikaboss was a short script I wrote to determine the compilation toolset of a Windoze PE. Every exe and dll compiled with Visual Studio will contain a Rich Header, which in turn contains a list of tools used to compile, assemble, and link all of the files in the project. However, that list is stored in numerical form and requires a lookup table to determine the original toolset. getrichlaikaboss will take LaikaBOSS JSON as input and return that list as output.


Popular posts from this blog

Yara and Rich Headers are full of win

Operation Cloud Hopper

"WannaCry Is North Korea!" or "Rich Headers Win Again!"