Recently Updated Pages
AnyCubic Photon Mono X 6K
Firmware and RERF file
Slicers
Lychee Slicer
RDPWrap - Windows Remote Desktop Wrapper
Most active to date: https://github.com/sebaxakerhtc/rdpwrap Config file update: https://github.c...
Netboot
apt update; apt install ipxe; wget 'https://boot.netboot.xyz/ipxe/netboot.xyz.lkrn' -O /boot/ipxe...
tun enabled for lxc
/etc/pve/lxc/###.conf lxc.cgroup2.devices.allow: c 10:200 rwm lxc.hook.autodev: sh -c "modprobe t...
aliases
alias dcud="docker-compose up -d" alias dcd="docker-compose down" alias dcp="docker-compose pul...
Microsoft Security
NTLM Brute Force
https://www.varonis.com/blog/investigate-ntlm-brute-force More specifically, you will need to us...
Cybersecurity Mesh Architecture
Splunk to Sentinel Logic
bin time doc | summarize initial_time = min(TimeGenerated), end_time = max(datetime_add("Second"...
Union Alert
// The query_now parameter represents the time (in UTC) at which the scheduled analytics rule ran...
Splunk Drill Down Events
earliest=$initial_time$ latest=$end_time$ index=$index$ EventCode=4624 NOT Logon_Type IN ("5") ho...
Splunk total run time
(index=_audit host=* action=search sourcetype=audittrail search_id!="rsa_*") | eval user = if(us...
Splunk Use Case tracker
| rest splunk_server=local count=0 /services/saved/searches | where disabled=0 | rename action.co...
Rule Sample
Log Analytics: Logs Rules Analytics OfficeActivity | where ingestion_time() > ago(5m) | where...
LogRhythm Or/And Previous
OR PREVIOUS works like an OR statement in parenthesis. a AND b OR PREVIOUS c would look like a &&...
Qradar global whitelist
Use Routing Rules with forwarding > bypass correlation For IP ranges, use Network Hierarchy.
Reference Maps
[http://www.siem.su/docs/ibm/Technical_remarks/Reference_Data_Collections_Technical_Note.pdf]
Qradar expiring whitelist
Use AQL filter query username LIKE 'testUser' and LONG(DATEFORMAT(starttime, 'yyyyMMdd')) < 2...
Ignore when another rule matches
When a building block or rule matches it's specific fields, do not fire matched events and NOT w...