🛡️ Blue Team Operations - Complete Reference

# Basic domain enumeration
theHarvester -d example.com -b google

# Multiple sources
theHarvester -d example.com -b google,bing,yahoo

# Limit results
theHarvester -d example.com -b google -l 500

# All sources
theHarvester -d example.com -b all

# Export to HTML
theHarvester -d example.com -b google -f results.html

# IP Address Filtering
ip.addr == 192.168.1.100           # Any traffic to/from IP
ip.src == 192.168.1.100            # Source IP
ip.dst == 192.168.1.100            # Destination IP

# Port Filtering
tcp.port == 80                     # TCP port 80 (any direction)
udp.port == 53                     # UDP port 53 (DNS)
tcp.srcport == 443                 # Source port
tcp.dstport == 8080                # Destination port

# Protocol Filtering
http                               # All HTTP traffic
dns                                # All DNS traffic
tls                                # All TLS/SSL traffic
ssh                                # All SSH traffic

# HTTP Specific
http.request.method == "POST"      # HTTP POST requests
http.request.uri contains "login"  # URIs containing "login"
http.response.code == 200          # HTTP 200 responses
http.host == "example.com"         # Specific host
http.cookie contains "session"     # Cookies with "session"

# DNS Specific
dns.qry.name == "malware.com"      # DNS query for domain
dns.qry.type == 1                  # A records
dns.qry.type == 28                 # AAAA records
dns.flags.response == 1            # DNS responses only

# TLS/SSL
tls.handshake.type == 1            # Client Hello
tls.handshake.type == 2            # Server Hello
ssl.record.content_type == 23      # Application Data

# String Search
frame contains "password"          # Frame contains string
tcp contains "flag"                # TCP payload contains string
http.request.uri contains ".php"   # URI contains .php

# Logical Operators
ip.addr == 10.0.0.1 && tcp.port == 80      # AND
ip.addr == 10.0.0.1 || ip.addr == 10.0.0.2 # OR
!(http)                                     # NOT (exclude HTTP)

# Advanced Filters
tcp.flags.syn == 1 && tcp.flags.ack == 0   # SYN packets (port scan)
tcp.analysis.retransmission                # Retransmissions
tcp.analysis.zero_window                   # Zero window (performance issue)

# Read PCAP file
tshark -r capture.pcap

# Apply display filter
tshark -r capture.pcap -Y "http.request"

# Extract specific fields
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port

# Statistics - Protocol Hierarchy
tshark -r capture.pcap -q -z io,phs

# Statistics - Conversations
tshark -r capture.pcap -q -z conv,tcp

# Statistics - HTTP requests
tshark -r capture.pcap -q -z http,tree

# Export HTTP objects
tshark -r capture.pcap --export-objects http,./exported/

# Follow TCP stream
tshark -r capture.pcap -z follow,tcp,ascii,0

# DNS queries only
tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name

# Extract unique IPs
tshark -r capture.pcap -T fields -e ip.src | sort -u
tshark -r capture.pcap -T fields -e ip.dst | sort -u

# Count packets by IP
tshark -r capture.pcap -T fields -e ip.src | sort | uniq -c | sort -rn

# Analyze PCAP file (creates logs in current directory)
zeek -r capture.pcap

# Analyze with specific scripts
zeek -r capture.pcap protocols/http/detect-sqli

# Output to specific directory
zeek -r capture.pcap LogAscii::output_to_file=./zeek_logs/

# List generated log files
ls *.log

# Common log files:
# conn.log       - Connection summary
# http.log       - HTTP requests/responses
# dns.log        - DNS queries
# ssl.log        - SSL/TLS certificates
# files.log      - Files transferred
# weird.log      - Unusual network activity

# View HTTP requests
zeek-cut method host uri < http.log

# DNS queries to specific domain
zeek-cut query answers < dns.log | grep malware.com

# SSL certificates
zeek-cut server_name < ssl.log | sort -u

# Top talkers by bytes
zeek-cut id.orig_h orig_bytes < conn.log | \
  awk '{ip=$1; bytes+=$2} END {for (i in ip) print bytes[i], i}' | \
  sort -rn | head -n 10

# Suspicious connections (no data transferred)
zeek-cut id.orig_h id.resp_h id.resp_p < conn.log | \
  awk '$4 == 0' | head

# Identify OS (always run first)
vol -f memory.dmp windows.info
vol -f memory.dmp linux.info

# Process Analysis
vol -f memory.dmp windows.pslist          # List processes
vol -f memory.dmp windows.pstree          # Process tree
vol -f memory.dmp windows.psscan          # Scan for processes (finds hidden)
vol -f memory.dmp windows.cmdline         # Command lines
vol -f memory.dmp windows.envars          # Environment variables

# Network Analysis
vol -f memory.dmp windows.netscan         # Network connections
vol -f memory.dmp windows.netstat         # Active connections

# Registry Analysis
vol -f memory.dmp windows.registry.hivelist  # List registry hives
vol -f memory.dmp windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"

# File System
vol -f memory.dmp windows.filescan        # Scan for file objects
vol -f memory.dmp windows.dumpfiles --pid 1234  # Dump files from process

# Malware Detection
vol -f memory.dmp windows.malfind         # Find injected code
vol -f memory.dmp windows.svcscan         # Scan for services
vol -f memory.dmp windows.dlllist --pid 1234    # DLLs loaded by process

# Memory Dump
vol -f memory.dmp windows.memmap --pid 1234 --dump  # Dump process memory
vol -f memory.dmp windows.moddump --pid 1234        # Dump executable module

# Suspicious Activity
vol -f memory.dmp windows.handles --pid 1234  # Open handles
vol -f memory.dmp windows.mutantscan          # Mutex objects

# Basic Search
index=main "error"
index=main sourcetype=access_combined status=404

# Time Range
index=main earliest=-1h
index=main earliest=-7d@d latest=@d

# Boolean Operators
index=main (error OR failed OR exception)
index=main error NOT success

# Wildcards
index=main host=web* sourcetype=*apache*

# Field Extraction
index=main | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"

# Statistical Commands
index=main | stats count by src_ip
index=main | stats sum(bytes) avg(response_time) by host
index=main | stats dc(user) as unique_users

# Table
index=main | table _time, src_ip, dest_ip, action

# Sort
index=main | stats count by src_ip | sort -count

# Timechart
index=main | timechart span=1h count by status

# Subsearch
index=main [search index=threat | fields malicious_ip | rename malicious_ip as src_ip]

# Transaction (group related events)
index=main | transaction session_id maxspan=30m

# Lookup (enrich with external data)
index=main | lookup threat_intel ip as src_ip OUTPUT threat_level

# Eval (calculate fields)
index=main | eval mb=bytes/1024/1024 | eval risk=if(mb>100, "high", "low")

# Where (filter results)
index=main | stats count by src_ip | where count > 100

# Dedup (remove duplicates)
index=main | dedup src_ip

# Top (most common values)
index=main | top limit=10 src_ip

# Rare (least common values)
index=main | rare limit=10 user_agent

# Failed Login Attempts
index=security EventCode=4625 | stats count by src_ip, user | where count > 5

# Successful Login After Failed Attempts
index=security (EventCode=4625 OR EventCode=4624) 
| transaction user maxspan=5m 
| search EventCode=4624 
| where eventcount > 1

# Port Scan Detection
index=firewall action=blocked 
| stats dc(dest_port) as port_count by src_ip 
| where port_count > 50

# Data Exfiltration (large outbound traffic)
index=firewall action=allowed direction=outbound 
| stats sum(bytes_out) as total_bytes by src_ip 
| where total_bytes > 1073741824

# Privilege Escalation
index=windows EventCode=4672 
| stats count by user 
| where user!="*$" AND user!="SYSTEM"

# PowerShell Download Cradle
index=windows EventCode=4104 
| search "*DownloadString*" OR "*IEX*" OR "*Invoke-Expression*"

# Suspicious Process Creation
index=windows EventCode=4688 
| search (NewProcessName="*powershell.exe*" OR NewProcessName="*cmd.exe*") 
  AND CommandLine="*-enc*" OR CommandLine="*-Encoded*"

# Lateral Movement (RDP)
index=security EventCode=4624 LogonType=10 
| stats dc(ComputerName) as systems_accessed by user 
| where systems_accessed > 3

# Set API key as environment variable
export VT_API_KEY="your_api_key_here"

# File Hash Lookup (SHA256/SHA1/MD5)
curl -X GET "https://www.virustotal.com/api/v3/files/FILE_HASH" \
  -H "x-apikey: $VT_API_KEY"

# Domain Report
curl -X GET "https://www.virustotal.com/api/v3/domains/example.com" \
  -H "x-apikey: $VT_API_KEY"

# IP Address Report
curl -X GET "https://www.virustotal.com/api/v3/ip_addresses/8.8.8.8" \
  -H "x-apikey: $VT_API_KEY"

# URL Scan
curl -X POST "https://www.virustotal.com/api/v3/urls" \
  -H "x-apikey: $VT_API_KEY" \
  -d "url=https://example.com"

# File Upload (< 32MB)
curl -X POST "https://www.virustotal.com/api/v3/files" \
  -H "x-apikey: $VT_API_KEY" \
  -F "file=@/path/to/file.exe"

# Parse JSON output with jq
curl -X GET "https://www.virustotal.com/api/v3/files/HASH" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

import requests
import time
import json

API_KEY = "your_api_key_here"
BASE_URL = "https://www.virustotal.com/api/v3"

def check_hash(file_hash):
    """Check file hash on VirusTotal"""
    url = f"{BASE_URL}/files/{file_hash}"
    headers = {"x-apikey": API_KEY}
    
    response = requests.get(url, headers=headers)
    
    if response.status_code == 200:
        data = response.json()
        stats = data['data']['attributes']['last_analysis_stats']
        print(f"Hash: {file_hash}")
        print(f"Malicious: {stats['malicious']}")
        print(f"Suspicious: {stats['suspicious']}")
        print(f"Undetected: {stats['undetected']}")
        print("-" * 50)
    else:
        print(f"Error checking {file_hash}: {response.status_code}")
    
    time.sleep(15)  # Rate limit: 4 requests/minute

# Read hashes from file
with open('hashes.txt', 'r') as f:
    hashes = f.read().splitlines()

for hash_value in hashes:
    check_hash(hash_value)

# System Info
Get-ComputerInfo | Select-Object WindowsVersion, OsHardwareAbstractionLayer

# Installed Software
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | 
  Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

# Running Processes
Get-Process | Select-Object ProcessName, Id, Path, Company | Sort-Object ProcessName

# Services
Get-Service | Where-Object {$_.Status -eq 'Running'} | 
  Select-Object Name, DisplayName, StartType

# Scheduled Tasks
Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'} | 
  Select-Object TaskName, TaskPath, State

# Startup Programs (Registry)
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# Active Network Connections
Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'} | 
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

# Get Process Name for Connection
Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'} | 
  Select-Object @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}},
                LocalAddress, LocalPort, RemoteAddress, RemotePort

# DNS Cache
Get-DnsClientCache | Select-Object Entry, Data

# Network Shares
Get-SmbShare

# Firewall Rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} | 
  Select-Object DisplayName, Direction, Action

# ARP Table
Get-NetNeighbor | Select-Object IPAddress, LinkLayerAddress, State

# Failed Logins (Last 24 hours)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | 
  Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[5].Value}},
                @{Name='IP';Expression={$_.Properties[19].Value}}

# Successful Logins
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-1)} | 
  Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[5].Value}},
                @{Name='LogonType';Expression={$_.Properties[8].Value}}

# Process Creation (requires Sysmon or audit policy)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-1)} | 
  Select-Object TimeCreated, @{Name='Process';Expression={$_.Properties[5].Value}},
                @{Name='CommandLine';Expression={$_.Properties[8].Value}}

# PowerShell Script Block Logging
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} | 
  Select-Object TimeCreated, Message | Out-GridView

# System Errors
Get-EventLog -LogName System -EntryType Error -Newest 50

# Recently Modified Files
Get-ChildItem -Path C:\ -Recurse -File -ErrorAction SilentlyContinue | 
  Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} | 
  Select-Object FullName, LastWriteTime, Length

# Find Files by Extension
Get-ChildItem -Path C:\Users -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | 
  Select-Object FullName, CreationTime, LastWriteTime

# Calculate File Hash
Get-FileHash -Path C:\suspicious\file.exe -Algorithm SHA256

# Batch Hash Calculation
Get-ChildItem -Path C:\suspicious -Recurse -File | 
  ForEach-Object {Get-FileHash $_.FullName -Algorithm SHA256} | 
  Select-Object Hash, Path | Export-Csv -Path hashes.csv

# Search File Content
Select-String -Path C:\logs\*.log -Pattern "malware.com"

# Alternate Data Streams (ADS)
Get-Item -Path C:\suspicious\file.txt -Stream *

# Local Users
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet

# Local Administrators
Get-LocalGroupMember -Group "Administrators"

# Currently Logged In Users
quser

# User Login History
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | 
  Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[5].Value}} | 
  Group-Object User | Select-Object Name, Count

# HTTP Requests
pip install requests

# JSON/CSV/Excel Processing
pip install pandas openpyxl

# Network Analysis
pip install scapy

# Threat Intelligence
pip install vt-py     # VirusTotal
pip install shodan    # Shodan

# SIEM Integration
pip install splunk-sdk

# IP/Domain Parsing
pip install ipaddress dnspython

# Regular Expressions (built-in)
import re

#!/usr/bin/env python3
"""
Quick IOC checker - VirusTotal & AbuseIPDB
"""
import requests
import sys

VT_API_KEY = "your_vt_api_key"
AIPDB_API_KEY = "your_abuseipdb_key"

def check_ip_abuseipdb(ip):
    """Check IP reputation on AbuseIPDB"""
    url = "https://api.abuseipdb.com/api/v2/check"
    headers = {
        "Key": AIPDB_API_KEY,
        "Accept": "application/json"
    }
    params = {"ipAddress": ip, "maxAgeInDays": "90"}
    
    response = requests.get(url, headers=headers, params=params)
    if response.status_code == 200:
        data = response.json()['data']
        print(f"\n[AbuseIPDB] {ip}")
        print(f"  Abuse Score: {data['abuseConfidenceScore']}%")
        print(f"  Total Reports: {data['totalReports']}")
        print(f"  Country: {data['countryCode']}")
        print(f"  ISP: {data['isp']}")
    else:
        print(f"Error checking {ip}: {response.status_code}")

def check_hash_vt(file_hash):
    """Check file hash on VirusTotal"""
    url = f"https://www.virustotal.com/api/v3/files/{file_hash}"
    headers = {"x-apikey": VT_API_KEY}
    
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
        data = response.json()['data']['attributes']
        stats = data['last_analysis_stats']
        print(f"\n[VirusTotal] {file_hash}")
        print(f"  Malicious: {stats['malicious']}/{sum(stats.values())}")
        print(f"  First Seen: {data['first_submission_date']}")
        print(f"  Names: {', '.join(data.get('names', []))[:100]}")
    else:
        print(f"Hash not found or error: {response.status_code}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python ioc_checker.py ")
        sys.exit(1)
    
    ioc = sys.argv[1]
    
    # Determine if IP or hash
    if "." in ioc:  # Simple IP check
        check_ip_abuseipdb(ioc)
    else:  # Assume hash
        check_hash_vt(ioc)

from scapy.all import rdpcap, IP, TCP, DNS

# Read PCAP file
packets = rdpcap('capture.pcap')

# Extract unique IPs
ips = set()
for pkt in packets:
    if IP in pkt:
        ips.add(pkt[IP].src)
        ips.add(pkt[IP].dst)

print(f"Unique IPs: {len(ips)}")
for ip in sorted(ips):
    print(ip)

# Extract DNS queries
dns_queries = []
for pkt in packets:
    if DNS in pkt and pkt[DNS].qr == 0:  # Query
        dns_queries.append(pkt[DNS].qd.qname.decode())

print(f"\nDNS Queries: {len(dns_queries)}")
for query in set(dns_queries):
    print(query)

# Find suspicious ports
suspicious_ports = [22, 23, 3389, 4444, 5555, 6666, 8080]
for pkt in packets:
    if TCP in pkt:
        if pkt[TCP].dport in suspicious_ports:
            print(f"Suspicious connection: {pkt[IP].src} -> {pkt[IP].dst}:{pkt[TCP].dport}")

# Search by hostname
hostname:example.com

# Search by IP address or CIDR
net:192.168.0.0/24

# Search by port
port:22
port:3389,445

# Search by service/product
product:Apache
product:"Microsoft IIS"

# Search by organization
org:"Google LLC"

# Search by country
country:US
country:ID

# Search by city
city:"Jakarta"

# Search by operating system
os:Windows
os:"Ubuntu Linux"

# Search by vulnerabilities (CVE)
vuln:CVE-2021-44228    # Log4Shell

# Combine filters
apache country:US port:443

# Find open webcams
title:"webcam" country:ID

# Find exposed databases
product:MongoDB port:27017 -authentication
product:MySQL port:3306

# Find IoT devices
product:"Hikvision IP Camera"
product:"Mikrotik RouterOS"

# Find exposed RDP
port:3389 country:US

# Find industrial control systems
tag:ics
tag:scada

# Install Shodan CLI
pip install shodan

# Configure API key
shodan init YOUR_API_KEY

# Search from command line
shodan search "apache country:US"

# Get host information
shodan host 8.8.8.8

# Download search results
shodan download results.json.gz "apache country:US"

# Parse downloaded results
shodan parse --fields ip_str,port,org results.json.gz

# Statistics
shodan stats --facets country "apache"

# Monitor your network
shodan alert create "My Network" 192.168.0.0/24
shodan alert list

# Set API key
export AIPDB_KEY="your_api_key_here"

# Check single IP
curl -G https://api.abuseipdb.com/api/v2/check \
  --data-urlencode "ipAddress=192.168.1.1" \
  -d maxAgeInDays=90 \
  -H "Key: $AIPDB_KEY" \
  -H "Accept: application/json" | jq

# Bulk check (up to 100 IPs)
curl -X POST https://api.abuseipdb.com/api/v2/check-block \
  -d "network=192.168.0.0/24" \
  -d maxAgeInDays=90 \
  -H "Key: $AIPDB_KEY" \
  -H "Accept: application/json"

# Report IP abuse
curl -X POST https://api.abuseipdb.com/api/v2/report \
  --data-urlencode "ip=192.168.1.100" \
  --data-urlencode "categories=18,22" \
  --data-urlencode "comment=Port scanning attempt" \
  -H "Key: $AIPDB_KEY"

# Category IDs:
# 18 = Brute Force
# 22 = DDoS Attack
# 14 = Port Scan
# 15 = Hacking
# 21 = Malware Distribution

import requests

API_KEY = "your_api_key_here"
URL = "https://api.abuseipdb.com/api/v2/check"

def check_ip(ip):
    headers = {
        "Key": API_KEY,
        "Accept": "application/json"
    }
    params = {
        "ipAddress": ip,
        "maxAgeInDays": "90"
    }
    
    response = requests.get(URL, headers=headers, params=params)
    
    if response.status_code == 200:
        data = response.json()['data']
        print(f"\nIP: {ip}")
        print(f"Abuse Score: {data['abuseConfidenceScore']}%")
        print(f"Total Reports: {data['totalReports']}")
        print(f"Country: {data['countryCode']}")
        print(f"Usage Type: {data['usageType']}")
        print(f"ISP: {data['isp']}")
        
        if data['abuseConfidenceScore'] > 75:
            print("⚠️  HIGH RISK - Block this IP!")
    else:
        print(f"Error: {response.status_code}")

# Read IPs from file
with open('ips.txt', 'r') as f:
    ips = f.read().splitlines()

for ip in ips:
    check_ip(ip)

# Scan single host
nmap 192.168.1.1

# Scan subnet
nmap 192.168.1.0/24

# Scan multiple hosts
nmap 192.168.1.1,10,20

# Scan range
nmap 192.168.1.1-254

# Scan from file
nmap -iL targets.txt

# Fast scan (100 most common ports)
nmap -F 192.168.1.1

# Scan all ports
nmap -p- 192.168.1.1

# Scan specific ports
nmap -p 22,80,443 192.168.1.1
nmap -p 1-1000 192.168.1.1

# Ping scan (host discovery only)
nmap -sn 192.168.1.0/24

# TCP SYN scan (default, requires root)
sudo nmap -sS 192.168.1.1

# TCP connect scan (no root required)
nmap -sT 192.168.1.1

# UDP scan
sudo nmap -sU 192.168.1.1

# Service version detection
nmap -sV 192.168.1.1

# OS detection
sudo nmap -O 192.168.1.1

# Aggressive scan (OS detection + version + scripts + traceroute)
sudo nmap -A 192.168.1.1

# Script scan
nmap -sC 192.168.1.1

# List all scripts
ls /usr/share/nmap/scripts/ | grep .nse

# Run default scripts
nmap --script=default 192.168.1.1

# Run specific script
nmap --script=http-title 192.168.1.1

# Multiple scripts
nmap --script=http-enum,http-headers 192.168.1.1

# Vulnerability detection
nmap --script=vuln 192.168.1.1

# SMB enumeration
nmap --script=smb-enum-shares,smb-enum-users 192.168.1.1

# Check for EternalBlue (MS17-010)
nmap --script=smb-vuln-ms17-010 192.168.1.1

# SSL/TLS checks
nmap --script=ssl-enum-ciphers -p 443 example.com

# Normal output
nmap -oN scan.txt 192.168.1.1

# XML output
nmap -oX scan.xml 192.168.1.1

# Grepable output
nmap -oG scan.grep 192.168.1.1

# All formats
nmap -oA scan 192.168.1.1

# Verbose output
nmap -v 192.168.1.1
nmap -vv 192.168.1.1  # More verbose

# Capture on default interface
sudo tcpdump

# Capture on specific interface
sudo tcpdump -i eth0

# Capture to file (pcap format)
sudo tcpdump -i eth0 -w capture.pcap

# Read from file
tcpdump -r capture.pcap

# Limit packet count
sudo tcpdump -c 100

# Verbose output
sudo tcpdump -v
sudo tcpdump -vv    # More verbose
sudo tcpdump -vvv   # Very verbose

# Show packet contents (hex + ASCII)
sudo tcpdump -X

# Show only hex
sudo tcpdump -xx

# Host filters
sudo tcpdump host 192.168.1.100
sudo tcpdump src 192.168.1.100
sudo tcpdump dst 192.168.1.100

# Network filters
sudo tcpdump net 192.168.1.0/24

# Port filters
sudo tcpdump port 80
sudo tcpdump portrange 80-443
sudo tcpdump src port 443
sudo tcpdump dst port 22

# Protocol filters
sudo tcpdump tcp
sudo tcpdump udp
sudo tcpdump icmp
sudo tcpdump arp

# Combine filters (AND)
sudo tcpdump host 192.168.1.100 and port 80

# OR condition
sudo tcpdump host 192.168.1.100 or host 192.168.1.200

# NOT condition
sudo tcpdump not port 22

# TCP flags
sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0'  # SYN packets
sudo tcpdump 'tcp[tcpflags] & tcp-rst != 0'  # RST packets

# HTTP traffic
sudo tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# DNS queries
sudo tcpdump -i eth0 udp port 53

# ICMP packets
sudo tcpdump icmp

# Capture HTTP traffic and show ASCII
sudo tcpdump -A -s 0 port 80

# Capture only SYN packets (port scanning detection)
sudo tcpdump 'tcp[13] & 2 == 2'

# Capture traffic between two hosts
sudo tcpdump host 192.168.1.1 and host 192.168.1.2

# Capture all traffic except SSH
sudo tcpdump not port 22

# Rotate capture files (1GB each)
sudo tcpdump -i eth0 -w capture.pcap -C 1000 -W 5

# Capture with timestamp
sudo tcpdump -tttt

# Filter by packet size
sudo tcpdump greater 1000  # Packets larger than 1000 bytes
sudo tcpdump less 100      # Packets smaller than 100 bytes

# Download Sysmon from Microsoft Sysinternals
# https://docs.microsoft.com/sysinternals/downloads/sysmon

# Install with default config
Sysmon64.exe -accepteula -i

# Install with SwiftOnSecurity config (recommended)
# Download config: https://github.com/SwiftOnSecurity/sysmon-config
Sysmon64.exe -accepteula -i sysmonconfig-export.xml

# Update configuration
Sysmon64.exe -c updated-config.xml

# Uninstall
Sysmon64.exe -u

# View recent process creations (Event ID 1)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 100 | 
  Where-Object {$_.Id -eq 1} | 
  Select-Object TimeCreated, Message

# Network connections (Event ID 3)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=3} | 
  Select-Object TimeCreated, @{Name='SourceIP';Expression={$_.Properties[8].Value}}, 
                @{Name='DestIP';Expression={$_.Properties[14].Value}}, 
                @{Name='DestPort';Expression={$_.Properties[16].Value}}

# DNS queries (Event ID 22)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=22} | 
  Select-Object TimeCreated, @{Name='Query';Expression={$_.Properties[5].Value}}

# Process accessing LSASS (credential dumping detection)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=10} | 
  Where-Object {$_.Properties[9].Value -like "*lsass.exe*"}

# PowerShell executions
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} | 
  Where-Object {$_.Properties[4].Value -like "*powershell*"}

# Suspicious network connections to rare ports
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=3} | 
  Where-Object {$_.Properties[16].Value -in @(4444, 5555, 6666, 8080)}

-- Start interactive shell
osqueryi

-- List all tables
.tables

-- Show table schema
.schema processes

-- Running processes
SELECT pid, name, path, cmdline FROM processes;

-- Processes listening on network ports
SELECT DISTINCT pid, name, protocol, local_port 
FROM processes p 
JOIN listening_ports lp ON p.pid = lp.pid;

-- Established network connections
SELECT pid, local_address, local_port, remote_address, remote_port 
FROM process_open_sockets 
WHERE state = 'ESTABLISHED';

-- Users with UID 0 (root/admin)
SELECT * FROM users WHERE uid = 0;

-- Logged in users
SELECT * FROM logged_in_users;

-- Installed applications (macOS)
SELECT name, version, path FROM apps;

-- Startup items
SELECT name, path, status FROM startup_items;

-- Chrome extensions
SELECT name, version, author, path FROM chrome_extensions;

-- USB devices
SELECT vendor, model, serial FROM usb_devices;

-- Running kernel modules (Linux)
SELECT name, size, used_by FROM kernel_modules;

-- Suspicious executables in temp folders
SELECT path, size, mode FROM file 
WHERE path LIKE '/tmp/%' AND mode LIKE '%x%';

-- Hash files
SELECT path, md5, sha256 FROM hash 
WHERE path = '/bin/bash';

-- Cron jobs
SELECT * FROM crontab;

-- Processes with network connections
SELECT p.name, p.path, p.cmdline, pos.remote_address, pos.remote_port
FROM processes p
JOIN process_open_sockets pos ON p.pid = pos.pid
WHERE pos.state = 'ESTABLISHED';

-- Unsigned executables (Windows)
SELECT path, name FROM processes 
WHERE path NOT IN (SELECT path FROM authenticode WHERE result = 'trusted');

-- Persistence via Registry (Windows)
SELECT * FROM registry 
WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run%';

-- SSH authorized keys
SELECT * FROM users u 
CROSS JOIN authorized_keys ak ON u.directory = ak.uid_dir;

-- Recently modified files
SELECT path, mtime, size FROM file 
WHERE path LIKE '/home/%' 
AND mtime > (SELECT unix_time FROM time) - 3600;

-- Cleartext passwords in memory (risky!)
SELECT pid, name FROM process_memory 
WHERE pattern LIKE '%password%';

1. Create New Case
   - Case Name: incident_2024_001
   - Case Number: IR-2024-001
   - Examiner: Your Name

2. Add Data Source
   - Disk Image: evidence.E01 / evidence.dd
   - Logical Files: folder containing files
   - Local Disk: C:\ (live analysis)

3. Configure Ingest Modules
   ✅ Recent Activity (browser, downloads)
   ✅ Hash Lookup (NSRL, known malware)
   ✅ File Type Identification
   ✅ Extension Mismatch Detector
   ✅ Embedded File Extractor
   ✅ Email Parser
   ✅ Encryption Detection
   ✅ Interesting Files Identifier
   ✅ PhotoRec Carver (deleted files)

4. Analysis
   - Review "Interesting Items"
   - Check "Web History"
   - Examine "Recent Documents"
   - Look at "Installed Programs"
   - Check Timeline for suspicious activity

5. Generate Report
   - File → Generate Report
   - HTML or Excel format

1. File → Create Disk Image
   
2. Select Source
   - Physical Drive (entire disk)
   - Logical Drive (C:, D:, etc.)
   - Image File (mount existing image)
   - Contents of Folder (logical files)

3. Choose Image Type
   - Raw (dd) - Simple, compatible
   - SMART (.s01) - AccessData format
   - E01 (EnCase) - Industry standard, compressed
   - AFF (Advanced Forensic Format)

4. Evidence Item Information
   - Case Number
   - Evidence Number
   - Description
   - Examiner Name
   - Notes

5. Image Destination
   - Image Filename: evidence_2024_001
   - Fragment Size: 4GB (for FAT32)
   - Compression: 6 (recommended for E01)
   - ✅ Verify images after creation
   - ✅ Create directory listings

6. Start Imaging
   - Monitor progress
   - Verify MD5/SHA1 hashes match

REM Image physical drive
ftkimager.exe \\.\PhysicalDrive0 "D:\Evidence\drive0" --e01 --compress 6 --verify

REM Image logical drive
ftkimager.exe C: "D:\Evidence\C_drive" --e01

REM List drives
ftkimager.exe --list-drives

REM Mount image as read-only drive
ftkimager.exe --mount "D:\Evidence\image.E01" --drive-letter X:

REM Export files from image
ftkimager.exe "image.E01" "output_folder" --export-dir "/Users/victim/Documents"

# Extract all strings
strings -n 6 -a malware.exe > all_strings.txt

# Find URLs
strings malware.exe | grep -Eo "https?://[^\s\"']+"

# Find IP addresses
strings malware.exe | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}'

# Find file paths
strings malware.exe | grep -E "^[A-Z]:\\\\"
strings malware.exe | grep -E "^/[a-z/]+"

# Find registry keys
strings malware.exe | grep "HKEY_"

# Find email addresses
strings malware.exe | grep -Eo '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'

# Find domains
strings malware.exe | grep -Eo "[a-zA-Z0-9.-]+\.(com|net|org|ru|cn|xyz)"

# Find suspicious API calls
strings malware.exe | grep -i "CreateRemoteThread"
strings malware.exe | grep -i "VirtualAllocEx"
strings malware.exe | grep -i "WriteProcessMemory"
strings malware.exe | grep -i "WinExec"

# Find encoding indicators
strings malware.exe | grep -i "base64"
strings malware.exe | grep -i "encode"
strings malware.exe | grep -i "decrypt"

# Compare strings before/after execution
strings malware.exe > before.txt
# Run in sandbox
strings malware_unpacked.exe > after.txt
diff before.txt after.txt

rule SimpleMalware
{
    meta:
        description = "Detects simple malware"
        author = "SOC Analyst"
        date = "2024-01-15"
        reference = "https://example.com/analysis"
        
    strings:
        $str1 = "malicious_string" ascii wide
        $str2 = "C:\\Windows\\Temp\\payload.exe" nocase
        $hex1 = { 4D 5A 90 00 }  // MZ header
        $hex2 = { E8 ?? ?? ?? ?? }  // CALL instruction with wildcard
        $regex1 = /https?:\/\/[a-z0-9.-]+\.(ru|cn)/ nocase
        
    condition:
        ($str1 or $str2) and $hex1 and filesize < 500KB
}

rule APT_Ransomware
{
    meta:
        malware_family = "Ransomware"
        threat_level = "high"
        
    strings:
        $ransom_note = "Your files are encrypted" nocase
        $bitcoin = /[13][a-km-zA-HJ-NP-Z1-9]{25,34}/  // Bitcoin address
        $file_ext = ".encrypted" nocase
        $api1 = "CryptEncrypt" ascii
        $api2 = "CreateMutex" ascii
        
    condition:
        3 of them and filesize > 100KB
}

rule Suspicious_PowerShell_Download
{
    strings:
        $ps1 = "powershell" nocase
        $download1 = "Net.WebClient" nocase
        $download2 = "DownloadFile" nocase
        $download3 = "Invoke-WebRequest" nocase
        $download4 = "wget" nocase
        $download5 = "curl" nocase
        $iex = "IEX" nocase
        $invoke = "Invoke-Expression" nocase
        
    condition:
        $ps1 and (any of ($download*)) and ($iex or $invoke)
}

# Scan single file
yara rules.yar suspicious.exe

# Scan directory recursively
yara -r rules.yar /path/to/samples/

# Show matched strings
yara -s rules.yar malware.exe

# Print tags
yara -g rules.yar malware.exe

# Scan process memory (Linux, requires root)
sudo yara rules.yar /proc/1234/mem

# Multiple rule files
yara rule1.yar rule2.yar rule3.yar sample.exe

# Timeout for slow scans
yara --timeout=60 rules.yar large_file.bin

# Use compiled rules (faster)
yarac rules.yar compiled_rules.yac
yara compiled_rules.yac sample.exe

import yara

# Compile rule from file
rules = yara.compile(filepath='rules.yar')

# Scan file
matches = rules.match('/path/to/sample.exe')

for match in matches:
    print(f"Rule: {match.rule}")
    print(f"Tags: {match.tags}")
    print(f"Strings:")
    for string in match.strings:
        print(f"  - {string}")

# Scan directory
import os
for root, dirs, files in os.walk('/samples/'):
    for file in files:
        filepath = os.path.join(root, file)
        matches = rules.match(filepath)
        if matches:
            print(f"[!] {filepath}: {[m.rule for m in matches]}")

# Awesome YARA (curated list)
git clone https://github.com/InQuest/awesome-yara.git

# YARA Rules by Florian Roth
git clone https://github.com/Neo23x0/signature-base.git

# ReversingLabs YARA rules
git clone https://github.com/reversinglabs/reversinglabs-yara-rules.git

# ESET YARA rules
git clone https://github.com/eset/malware-ioc.git

# docker-compose.yml
version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.security.enabled=false
    ports:
      - "9200:9200"
    volumes:
      - esdata:/usr/share/elasticsearch/data

  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch

  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    ports:
      - "5000:5000"
      - "9600:9600"
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    depends_on:
      - elasticsearch

volumes:
  esdata:

# Start ELK Stack
docker-compose up -d

# Access Kibana
# http://localhost:5601

# Check Elasticsearch
curl http://localhost:9200

# logstash.conf
input {
  beats {
    port => 5044
  }
  
  tcp {
    port => 5000
    codec => json
  }
  
  file {
    path => "/var/log/auth.log"
    start_position => "beginning"
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGLINE}" }
    }
    date {
      match => [ "timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
  
  if [source_ip] {
    geoip {
      source => "source_ip"
      target => "geoip"
    }
  }
  
  # Enrich with threat intelligence
  if [ip] {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "threat_intel"
      query_template => "ip_lookup.json"
      fields => { "threat_score" => "threat_score" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "logs-%{+YYYY.MM.dd}"
  }
  
  stdout {
    codec => rubydebug
  }
}

// Search for failed SSH logins
GET /logs-*/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "event_type": "authentication" }},
        { "match": { "status": "failed" }},
        { "match": { "service": "ssh" }}
      ],
      "filter": {
        "range": {
          "@timestamp": {
            "gte": "now-24h"
          }
        }
      }
    }
  },
  "aggs": {
    "top_source_ips": {
      "terms": {
        "field": "source_ip.keyword",
        "size": 10
      }
    }
  }
}

// Detect brute force (>10 failures in 5 minutes)
GET /logs-*/_search
{
  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-5m"
      }
    }
  },
  "aggs": {
    "by_source": {
      "terms": {
        "field": "source_ip.keyword",
        "min_doc_count": 10
      }
    }
  }
}

// Find PowerShell encoded commands
GET /logs-*/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "process_name": "powershell.exe" }},
        { "regexp": { "command_line": ".*-enc.*" }}
      ]
    }
  }
}

# Failed logins
event.action:"authentication_failure"

# Specific user
user.name:"admin" AND event.outcome:"failure"

# Multiple values
event.code:(4625 OR 4624)  # Windows Event IDs

# IP range
source.ip >= 192.168.1.0 AND source.ip <= 192.168.1.255

# Wildcards
process.name:powershell*

# NOT operator
NOT user.name:"admin"

# Time range
@timestamp >= "2024-01-01" AND @timestamp < "2024-01-02"

# Port scanning detection
destination.port > 1000 AND destination.port < 65535 
AND event.action:"network_connection"

1. Start Burp → Proxy tab → Intercept is on
   Default: 127.0.0.1:8080

2. Configure Browser Proxy
   Firefox: Settings → Network → Manual Proxy
   - HTTP Proxy: 127.0.0.1
   - Port: 8080
   - ✅ Use this proxy for HTTPS

3. Install Burp CA Certificate
   - Browse to http://burp
   - Download cacert.der
   - Import to browser/system certificates

4. Intercept Traffic
   - Browse target site
   - View/modify requests in Proxy → Intercept
   - Forward or Drop packets

# 1. Map Application (Spider)
Target → Site map → Right-click domain → Spider this host

# 2. Identify Injection Points
- Look for parameters in GET/POST
- Check cookies, headers, JSON bodies

# 3. Test with Repeater
- Right-click request → Send to Repeater
- Modify parameters, observe responses
- Test: SQLi, XSS, command injection

# 4. Fuzz with Intruder
- Send to Intruder
- Mark payload positions: §param§
- Choose attack type (Sniper, Battering Ram, Pitchfork)
- Load wordlist
- Start attack, analyze results

# 5. Common Payloads to Test
SQL Injection: ' OR '1'='1, 1' UNION SELECT NULL--
XSS: , 
Command Injection: ; whoami, | cat /etc/passwd
Path Traversal: ../../../etc/passwd
SSRF: http://localhost:8080, http://169.254.169.254

# 6. Check for Vulnerabilities
- Missing security headers
- Sensitive data exposure
- Insecure authentication
- CSRF tokens missing

# Basic scan
nikto -h http://example.com

# HTTPS scan
nikto -h https://example.com

# Scan specific port
nikto -h example.com -p 8080

# Multiple ports
nikto -h example.com -p 80,443,8080

# Use proxy
nikto -h example.com -useproxy http://127.0.0.1:8080

# Save output
nikto -h example.com -o report.html -Format html
nikto -h example.com -o report.txt -Format txt
nikto -h example.com -o report.xml -Format xml

# Scan multiple hosts from file
nikto -h targets.txt

# Update plugins
nikto -update

# Tuning (select test types)
nikto -h example.com -Tuning 1234
# 1 = Interesting File / Seen in logs
# 2 = Misconfiguration
# 3 = Information Disclosure
# 4 = Injection (XSS/Script/HTML)
# 5 = Remote File Retrieval
# 6 = Denial of Service
# 7 = Remote File Retrieval (inside web root)
# 8 = Command Execution / Remote shell
# 9 = SQL Injection
# 0 = File Upload
# a = Authentication Bypass
# b = Software Identification
# c = Remote Source Inclusion

# Skip specific tests
nikto -h example.com -Tuning x 9  # Skip SQL injection tests

# Display options
nikto -h example.com -Display V  # Verbose

# Pretty print JSON
echo '{"name":"John","age":30}' | jq '.'
cat file.json | jq '.'

# Extract single field
echo '{"name":"John","age":30}' | jq '.name'
# Output: "John"

# Extract nested field
echo '{"user":{"name":"John","email":"john@example.com"}}' | jq '.user.email'

# Extract array element
echo '["apple","banana","cherry"]' | jq '.[1]'
# Output: "banana"

# Get array length
echo '[1,2,3,4,5]' | jq 'length'

# Get all keys
echo '{"name":"John","age":30,"city":"NYC"}' | jq 'keys'

# Multiple fields
echo '{"name":"John","age":30,"city":"NYC"}' | jq '.name, .age'

# Create new object
echo '{"name":"John","age":30}' | jq '{username: .name, user_age: .age}'

# Iterate array
echo '[{"name":"John"},{"name":"Jane"}]' | jq '.[]'

# Extract field from each array element
echo '[{"name":"John","age":30},{"name":"Jane","age":25}]' | jq '.[].name'
# Output:
# "John"
# "Jane"

# Filter array
echo '[1,2,3,4,5]' | jq '.[] | select(. > 3)'
# Output: 4, 5

# Map over array
echo '[1,2,3]' | jq 'map(. * 2)'
# Output: [2,4,6]

# Sort array
echo '[3,1,4,1,5]' | jq 'sort'

# Unique values
echo '[1,2,2,3,3,3]' | jq 'unique'

# Group by field
echo '[{"type":"A","value":1},{"type":"B","value":2},{"type":"A","value":3}]' | jq 'group_by(.type)'

# Parse Zeek logs (JSON format)
cat conn.log | jq 'select(.id.resp_p == 22) | {src: .id.orig_h, dst: .id.resp_h}'

# Extract IPs from API response
curl -s https://api.shodan.io/shodan/host/8.8.8.8 | jq '.data[].ip_str'

# Filter failed login attempts from JSON logs
cat auth.log.json | jq 'select(.event_type == "authentication" and .result == "failed")'

# Count events by type
cat security.log.json | jq 'group_by(.event_type) | map({event: .[0].event_type, count: length})'

# Extract all URLs from threat intel feed
cat iocs.json | jq '.indicators[] | select(.type == "url") | .value'

# Parse AWS CloudTrail logs
cat cloudtrail.json | jq '.Records[] | select(.eventName == "ConsoleLogin" and .errorCode != null)'

# VirusTotal results - get malicious detections
cat vt_result.json | jq '.data.attributes.last_analysis_stats | {malicious, suspicious}'

# Parse Suricata EVE JSON
cat eve.json | jq 'select(.event_type == "alert") | {timestamp, alert: .alert.signature, src_ip, dest_ip}'

# Elasticsearch query results
cat es_response.json | jq '.hits.hits[]._source | {timestamp, user, action}'

# Convert to CSV (with proper escaping)
cat data.json | jq -r '.[] | [.timestamp, .user, .action] | @csv'

# Conditional selection
cat logs.json | jq 'select(.level == "ERROR" or .level == "CRITICAL")'

# Check if field exists
cat data.json | jq 'select(.email != null)'

# Regex matching
cat logs.json | jq 'select(.message | test("failed|error"; "i"))'

# Contains
cat data.json | jq 'select(.tags | contains(["malware"]))'

# Arithmetic
cat data.json | jq '.[] | select(.score > 75 and .score < 100)'

# String concatenation
cat data.json | jq '.full_name = .first_name + " " + .last_name'

# Date parsing (requires date functions in jq 1.6+)
cat logs.json | jq 'select((.timestamp | fromdateiso8601) > now - 3600)'

#!/bin/bash

# Variables
name="SOC Analyst"
count=10

# Print
echo "Hello, $name"
echo "Count: $count"

# Command substitution
current_date=$(date +%Y-%m-%d)
hostname=$(hostname)

# User input
read -p "Enter IP address: " ip

# If statement
if [ "$count" -gt 5 ]; then
    echo "Count is greater than 5"
elif [ "$count" -eq 5 ]; then
    echo "Count is exactly 5"
else
    echo "Count is less than 5"
fi

# For loop
for i in {1..5}; do
    echo "Iteration $i"
done

# While loop
counter=0
while [ $counter -lt 5 ]; do
    echo "Counter: $counter"
    ((counter++))
done

# Functions
function check_port() {
    local host=$1
    local port=$2
    nc -zv $host $port &>/dev/null
    if [ $? -eq 0 ]; then
        echo "Port $port is open on $host"
    else
        echo "Port $port is closed on $host"
    fi
}

check_port 192.168.1.1 22

#!/bin/bash
# Analyze Apache access logs for suspicious activity

LOG_FILE="/var/log/apache2/access.log"

echo "=== Top 10 IPs by request count ==="
awk '{print $1}' $LOG_FILE | sort | uniq -c | sort -rn | head -10

echo -e "\n=== Top 10 requested URLs ==="
awk '{print $7}' $LOG_FILE | sort | uniq -c | sort -rn | head -10

echo -e "\n=== Failed requests (4xx, 5xx) ==="
awk '$9 ~ /^[45]/ {print $9, $7}' $LOG_FILE | sort | uniq -c | sort -rn

echo -e "\n=== Potential SQL injection attempts ==="
grep -i "union.*select\|' or '1'='1\|concat.*0x" $LOG_FILE

echo -e "\n=== Potential XSS attempts ==="
grep -i "