Redscale is a repository for Threat Intel indicators.

It is based on the STIX 2.1 format.
Redscale enables ingestion of single or bulk indicators using a web form, or by uploading a STIX JSON file.
Indicators can be exported in Splunk ES Threat Intelligence CSV format for upload into Splunk.
Redscale is a web server PowerShell script that runs on vanilla Windows, access is via a web browser.

• id - A unique identifier for the object.
• Collection - A unique identifier for a single/group of reports/indicators.
• Report - A unique identifier for a single/group of indicators.
• type - The type of object/indicator.
• object_refs - A list of identifiers to link objects together.
• created_by_ref - A unique identifier for the creator of the object, possibly source vendor.
• created - Timestamp of when the object was created.
• modified - Timestamp of when the object was last modified.
• published - Timestamp of when the report was published.
• object_marking_refs - Traffic Light Protocol (TLP) marking that provides context about the object's usage restrictions.
• confidence - The degree of certainty that an indicator is malicious.
• name - A human-readable name for the object.
• description - A description of the object and why it's relevant.
• pattern - A STIX pattern that specifies the conditions for detecting the indicator.
• valid_from - Timestamp indicating when the object is expected to be valid.
• Valid Days - The number of days the object is valid for after it becomes valid.
• Sharing - Who the object can be shared with.
• Comments - Comments
• Splunk 1 - domain_intel: domain | email_intel: src_user | file_intel: file_hash | http_intel: url | ip_intel: ip | process_intel: process | registry_intel: registry_path | service_intel: service | user_intel: user | certificate-intel: certificate_serial (The Splunk column the indicator needs to be mapped to depending on the type.)
• Splunk 2 - email_intel: subject | file_intel: file_name | http_intel: http_user_agent | process_intel: process_file_name | registry_intel: registry_value_name | service_intel: service_file_hash | certificate-intel: certificate_issuer#certificate_issuer_organization#certificate_issuer_unit (The Splunk column the indicator needs to be mapped to depending on the type.)
• Splunk 3 - http_intel: http_referrer | registry_intel: registry_value_text | service_intel: service_dll_file_hash | certificate-intel: certificate_subject#certificate_subject_organization#certificate_subject_unit (The Splunk column the indicator needs to be mapped to depending on the type.)
• Notify - Send email if the indicator is detected in Splunk.
• Retro - Perform a retrospective search from the indicator's valid_from timestamp.

Note: Lowercase field names are taken from the STIX 2.1 specification.

1. Start Windows PowerShell - Run as Administrator
2. One-Time execute command: Set-ExecutionPolicy RemoteSigned
3. Extract redscale.zip, change to redscale folder.
4. Execute command: .\redscale.ps1

• Redscale 3.0.0: redscale-3.0.0.zip (78540B SHA1:bdb0f61ad96968c7d93decff43491527a79edf4d)

PacketZero is a 3D network monitor, displaying hosts and packet traffic. Features include support for multiple sensors (sensor0), analysis of packets to gather hostnames and services, configurable layout of subnetworks, recording/replaying of packet traffic, and the ability to filter packets by hosts, protocol or port.

sensor0 is a packet capture agent which reads and sends packet header information to PacketZero, locally or remotely. sensor0 also equates hostname to IP by reading DNS packets (UDP type A class IN standard query response). Multiple sensors can send information to multiple computers running PacketZero on the same subnet via broadcast.

• PacketZero Source 1.0.3: PacketZero-1.0.3.tar.gz (45782B SHA1:5b19647cf923858ba8733eb33bcc94e39ebeca9b)
• sensor0 Source 1.0.2: sensor0-1.0.2.tar.gz (6714B SHA1:1b2caf03c26195b062e52d75b87c1c1b55861505)
• sensor0 Simulator 0.1: sensor0-sim.py (1288B SHA1:d735b911cd456d0d73cb7f047a72bbbd01c68959)
• PacketZero man page 26 May 16: packet0.1
• sensor0 man page 26 May 16: sensor0.1
• PacketZero README 26 May 16: PacketZero_README.txt

• 3-Button Scroll Mouse
• OpenGL Support

• sensor0 requires libpcap/WinPcap.
• PacketZero requires Simple DirectMedia Layer 2.0 (SDL2).
• Mac OS X: Download https://www.libsdl.org/tmp/release/SDL2-2.0.4.dmg, put SDL2.framework in /Library/Frameworks/

• Linux: Install g++, SDL2 (dev), libpcap (dev), compile using "compile-packet0.sh" and "compile-sensor0.sh" scripts.
• Mac OS X: Install Xcode, compile using "compile-packet0.sh" and "compile-sensor0.sh" scripts.
• Windows (sensor0 only): Install Visual Studio Community and WinPcap Developer Pack.

• Linux, Mac OS X:
• Put executables "packet0" and "sensor0" in /usr/local/bin/
• Put man pages "packet0.1" and "sensor0.1" in /usr/local/share/man/man1/
• These directories may have to be created.
• Firewall Configuration:
• By default, sensor0 talks to PacketZero via UDP port 6333.

Starting order does not matter, however if sensor0 is running and PacketZero is not, ICMP Port Unreachable (UDP port 6333) may be generated.

• Linux, Mac OS X:

  sensor0 [-i <interface/file>] [-s <id>] [-h <destination>] [-u <port>] [-p] [-d]
    -i <interface> - Listen on interface (en0, eth1, ppp0, wlan0, etc.); or
       <file> - Read packets from pcap file.  Standard input is used if file is "-".
    -s <id> - Identify packets from a specific sensor when multiple exist (1-255, default 1).
    -h <destination> - PacketZero IP or broadcast address (default localhost).
    -u <port> - PacketZero UDP port (default 6333).
    -p - Enable promiscuous mode.
    -d - Run as daemon.

• Omit "-i <interface/file>" to display an Interface List for selection.
• Capturing packets requires you start sensor0 as root.
• View syslog to assist troubleshooting.


• Windows:

  sensor0.exe [[[<id>] <destination>] <port>] [-p]
    <id> - Identify packets from a specific sensor when multiple exist (1-255, default 1).
    <destination> - PacketZero IP or broadcast address (default localhost).
    <port> - PacketZero UDP port (default 6333).
    -p - Enable promiscuous mode.

Created in directory:

• Linux: ~/.packet0/
• Mac OS X: ~/Library/Application Support/PacketZero/

Files:

• controls.txt - Controls
• packet0_prefs - Preferences
• 0network_0nl - Network Layout On-Exit
• 1network_0nl - Network Layout 1
• 2network_0nl - Network Layout 2
• 3network_0nl - Network Layout 3
• 4network_0nl - Network Layout 4
• netpos.txt - CIDR Notation Net Position/Colour
• traffic_0pt - Packet Traffic Record
• tmp_packet0 - Temporary Data

If a host is not a member of any net position entries, it is placed in the Grey Zone. If a host is a member of multiple net position entries, the first entry is used. Line format for net position entries is "pos net x-position y-position z-position colour", eg. "pos 123.123.123.123/32 10 0 -10 green".

Positions:

• Grey/Red - positive x-position
• Blue/Green - negative x-position
• Up - positive y-position
• Down - negative y-position
• Grey/Blue - positive z-position
• Red/Green - negative z-position

Colours:

• none (where multiple colours are used)
• default (grey)
• orange
• yellow
• fluro
• green
• mint
• aqua
• blue
• purple
• violet
• hold (place hosts in same position)

If sudo is required to start/stop a local sensor, the user starting sensor0 must be in /etc/sudoers. The default command to stop a local sensor is "killall sensor0", which will kill all sensor0 processes. Add the following to /etc/sudoers, replacing <user> with the required username:

  <user> ALL=(root) NOPASSWD: /usr/local/bin/sensor0
  <user> ALL=(root) NOPASSWD: /usr/bin/killall

Press H key in PacketZero to show controls.

• Support only for IPv4.
• IP headers with options are ignored.
• Support for packets with optionless GRE or VLAN 802.1Q encapsulation.
• By default hosts are added to PacketZero from packet source IP address, activate Add Destination Hosts to also add from destination IP address.
• Anomalies are a new host or host service.
• Clicking a host cluster will cycle through selecting hosts within.
• Using the menu options to move/arrange a few thousand hosts may take a few minutes.

Logalysis is a Security Information Manager with built-in log/pcap analysis tools.

The back-end is HTML/PHP/MySQL based (a simple LAMP server is required) with the clients connecting using Mozilla Firefox or Google Chrome browsers.
Incidents can be generated automatically from network events, or created from the real-time section which lists current events occurring in your network.
Displayed log entries can be dynamic, containing links to other data, to allow quicker analysis.
Generated pcaps can be broken into sessions and their text displayed using tcpflow, or Foremost can be used for data carving.
Logalysis is plug-in based allowing log, pcap, chart, and report generation to be customised to the appliances within your network. Plug-ins are simple to write allowing your security team to expand the system's capability.

• Apache2 (access.log)
• McAfee Network Security Manager (IPS events)
• Snort (IDS/IPS events)
• Solera (pcap generation)
• Sourcefire Defence Centre (IPS events)
• Sourcefire Defence Centre (RNA events)
• Squid (access.log)

• Logalysis 1.0.2: logalysis-1.0.2.tar.gz (364856B SHA1:c02856de354ba9c5698f6d832e640a5abfdb21ff)
• Logalysis Plug-ins 1.0.1: logalysis-plugins-1.0.1.tar.gz (2250975B SHA1:44aac7ef3d35b128fc7113bfc014fa04d243d89e)
• Logalysis README 27 May 16: Logalysis_README.txt

Files and documentation to deploy a simple Splunk Enterprise lab with auth, firewall, HTTP and SMTP logs.
Laconic is a simple multi-threaded web server, which logs all requests for analysis.
Smurt acts like a SMTP MTA, which logs all transfers for analysis.

• Splunk Lab 1.0.0: splunk_lab_1.0.0.tar.gz (7483B SHA1:ff9aaec9ac3e2e4b424724dfd18f907c8586ffdc)

UBUNTU SERVER DEPLOY
1. Download Ubuntu Server LTS from https://ubuntu.com/download/server
2. Install Ubuntu Server ISO to USB drive.
3. Boot Ubuntu Server from USB drive.
4. Select Language e.g. English.
5. Select Keyboard Layout e.g. English (US).
6. Select Type of Installation = Ubuntu Server (minimized).
7. Set Network and Proxy Configuration.
8. Select Ubuntu Archive Mirror.
9. Configure Storage Layout.
10. Configure user/system names and password.
11. Skip Upgrade to Ubuntu Pro.
12. Select Install OpenSSH server.
13. No Server Snaps.
14. After installation, reboot the server.

CONFIGURE UBUNTU
1. Login to the system.
2. Execute commands:

  sudo su
  apt update
  apt upgrade  (if required)
  apt install vim nftables netsniff-ng
  
3. Disallow SSH root login:

  vim /etc/ssh/sshd_config
Change '#PermitRootLogin prohibit-password' to:
  PermitRootLogin no
Save file and execute command:
  systemctl restart ssh
  
4. Create a no login access user 'www':
  useradd -r -s /usr/sbin/nologin www

SETUP LAB SERVICES
1. Copy splunk_lab_1.0.0.tar.gz to server.
2. Extract splunk_lab_1.0.0.tar.gz
3. Edit the default network interface and service ports in:
  - laconic.pl
  - nftables.conf
  - pcaps.sh
  - smurt.pl
4. Execute commands, as root:

  cp splunk_lab/auth.service /etc/systemd/system/auth.service
  chmod 664 /etc/systemd/system/auth.service
  systemctl enable --now auth.service
  cp splunk_lab/auth.logrotated /etc/logrotate.d/auth

  cp splunk_lab/firewall.service /etc/systemd/system/firewall.service
  chmod 664 /etc/systemd/system/firewall.service
  systemctl enable --now firewall.service
  cp splunk_lab/firewall.logrotated /etc/logrotate.d/firewall

  cp splunk_lab/nftables.conf /etc/nftables.conf
  nft -f /etc/nftables.conf

  cp splunk_lab/pcaps.sh /usr/local/sbin/pcaps.sh
  chmod 750 /usr/local/sbin/pcaps.sh
  mkdir /var/log/pcaps
  chmod 755 /var/log/pcaps
  cp splunk_lab/pcaps.service /etc/systemd/system/pcaps.service
  chmod 664 /etc/systemd/system/pcaps.service
  systemctl enable --now pcaps.service

  cp splunk_lab/laconic.pl /usr/local/bin/laconic.pl
  touch /var/log/http.log
  mkdir /var/log/web
  mkdir /var/www
  chown www:www /usr/local/bin/laconic.pl /var/log/http.log /var/log/web /var/www
  chmod 750 /usr/local/bin/laconic.pl /var/log/web /var/www
  chmod 644 /var/log/http.log
  cp splunk_lab/laconic.service /etc/systemd/system/laconic.service
  chmod 664 /etc/systemd/system/laconic.service
  systemctl enable --now laconic.service

  cp splunk_lab/smurt.pl /usr/local/bin/smurt.pl
  touch /var/log/smtp.log
  mkdir /var/log/mail
  chown www:www /usr/local/bin/smurt.pl /var/log/smtp.log /var/log/mail
  chmod 750 /usr/local/bin/smurt.pl /var/log/mail
  chmod 644 /var/log/smtp.log
  cp splunk_lab/smurt.service /etc/systemd/system/smurt.service
  chmod 664 /etc/systemd/system/smurt.service
  systemctl enable --now smurt.service

5. Port forward 25 to 5123 on border for Smurt.
6. Port forward 80 to 8123 on border for Laconic.

SPLUNK DEPLOY
1. Login to splunk.com
2. Navigate to My Dashboard -> Free Trials and Downloads -> Splunk Enterprise.
3. Copy the Linux .deb wget link, execute on server to download Splunk.
4. Execute commands, as root:

  dpkg -i splunk-???.deb
  /opt/splunk/bin/splunk enable boot-start  (enter an admin username/password)
  vim /etc/init.d/splunk
Add '--run-as-root' to:
  "/opt/splunk/bin/splunk" start --no-prompt --answer-yes --run-as-root
Save file
  systemctl daemon-reload
  systemctl start splunk.service

CONFIGURE SPLUNK
1. Login to Splunk on server via a web browser, http://:8000
2. Input Laconic data:

  - Navigate to Settings -> Data inputs -> Files & Directories + Add new
  - Select Source -> File or Directory: /var/log/http.log -> Next
  - Set Source Type -> Next
  - Save Source Type:
    Name = laconic
    Category = Web
    App = Search & Reporting
  - Save
  - Input Settings -> Review -> Submit
  - Done -> Extract Fields -> I prefer to write the regular expression myself:

  ^(?:[^\s\n]*\s){3}(?P[^:]+):(?P\d+)\->(?P[^:]+):(?P\d+)\s(?P\d+)\s"(?P[^\s]+)\s(?P[^"]+)"\s"(?P[^"]+)"\s"(?P[^"]+)"\s"(?P[^"]+)"\s(?P\d{3})\s(?P\d+)?

  - Save
    Extractions Name = EXTRACT-http
    Permissions = App
  - Finish

3. Input Smurt data:

  - Navigate to Settings -> Data inputs -> Files & Directories + Add new
  - Select Source -> File or Directory: /var/log/smtp.log -> Next
  - Set Source Type -> Next
  - Save Source Type:
    Name = smurt
    Category = Email
    App = Search & Reporting
  - Save
  - Input Settings -> Review -> Submit
  - Done -> Extract Fields -> I prefer to write the regular expression myself:

  ^(?:[^\s\n]*\s){3}(?P[^:]+):(?P\d+)\->(?P[^:]+):(?P\d+)\s(?P\d+)\s"(?P[^"]+)"\s"(?P[^"]+)"\s"(?P[^"]+)"\s(?P\d+)?

  - Save
    Extractions Name = EXTRACT-smtp
    Permissions = App
  - Finish
  
4. Input nftables data:

  - Navigate to Settings -> Data inputs -> Files & Directories + Add new
  - Select Source -> File or Directory: /var/log/firewall.log -> Next
  - Set Source Type -> Next
  - Save Source Type:
    Name = nft
    Category = Network & Security
    App = Search & Reporting
  - Save
  - Input Settings -> Review -> Submit
  - Done -> Extract Fields -> I prefer to write the regular expression myself:

  ^(?:[^\s\n]*\s){3}\w+\skernel:\snft:\s(?P[^\s]+)\sIN=(?P[^\s]*)\sOUT=(?P[^\s]*)\s(MAC=(?P[^\s]+)\s)?SRC=(?P[^\s]+)\sDST=(?P[^\s]+)\sLEN=(?P[^\s]+)\s.+\sPROTO=(?P[^\s]+)\s(TYPE=(?P[^\s]+)\s)?(SPT=(?P[^\s]+)\sDPT=(?P[^\s]+)\s)?
  
  - Save
    Extractions Name = EXTRACT-nft
    Permissions = App
  - Finish

5. Input auth.log data:

  - Navigate to Settings -> Data inputs -> Files & Directories + Add new
  - Select Source -> File or Directory: /var/log/auth.log -> Next
  - Set Source Type -> Source type: syslog (under Operating System) -> Next
  - Input Settings -> Review -> Submit

6. Add date field for Laconic:

  - Navigate to Settings -> Fields -> Calculated fields + Add new
  - Add new:
    Destination app = search
    Apply to = sourcetype
    named = laconic
    Name = date
    Eval expression = strftime(_time, "%Y-%m-%d")
  - Save
  - Navigate to Settings -> Fields -> Calculated fields -> laconic: EVAL-date -> Settings -> Permissions
  - Permissions:
    Object should appear in = This app only (search)
    Roles Read = Everyone
    Roles Write = admin
  - Save

7. Add Show Request Workflow action for Laconic:

  - Navigate to Settings -> Fields -> Workflow actions + Add new
  - Add new:
    Destination app = search
    Name = laconic_request
    Label = Show Request
    Apply only to the following fields = date,req_id
    Apply only to the following event types = 
    Show action in = Event menu
    Action type = link
    URL = http://:8123/?date=$date$&web=$req_id$
    Open link in = New window
    Link method = get
  - Save
  - Navigate to Settings -> Fields -> Workflow actions -> laconic_request -> Settings -> Permissions
  - Permissions:
    Object should appear in = This app only (search)
    Roles Read = Everyone
    Roles Write = admin
  - Save
    

This is a project I did during COVID-19 to create a simple serverless managed e-commerce website solution.

• Easily customisable, it only requires:
1. A business name (or logo).
2. A background image (store photo).
3. "About" speal.
4. Location, contact, social media, delivery links (if applicable).
5. Item list (text layout can have sections, items, options, extras and notes).
• Website hosted for free on GitHub, with a TLS (HTTPS) certificate for data security.
• Stripe handles the secure payments by debit/credit card, Apple Pay and Google Pay.
• Customer access via a mobile/desktop browser, no app to install.
• No customer accounts required, no HTTP cookies, no user tracking.
• Customer's favorite item can be saved in a bookmark.

• eStore 1.0.4: estore-1.0.4.zip (1707825B SHA1:3b47c5fe258389872bc62a8021004d66fdd33f80)

Miscellaneous code which you may find useful:

Bluffer is a Network Service Imitator which attempts to extract the network activity from malware. Once the network activity of the malware is known, logs can be searched to determine if the malware has executed successfully, determine the scope of hosts infected, or observe the spread of the infection.

• ARP
• ICMP
• TCP
• UDP
• DNS
• NBNS
• DHCP Inform
• WPAD
• HTTP
• SMTP
• POP3
• IMAP
• TFTP
• FTP

Bluffer resides on a Ubuntu VM which is connected to a Windows VM (which the malware is run on) via a Host-only network. The default route for the Windows VM is the IP address of the Ubuntu VM.

• Bluffer 1.0.2: bluffer.cpp (21771B SHA1:a6edb8edee92bc560a34bf42ec4b07fe57ccc03c)

gush.c (10637B SHA1:1efcde891c2b8152b779e8a01b33ec0a15e85fe4)

mirror.c (3718B SHA1:fb71518295020187c88aa7990970318f698d44ea)

edate.js (1845B SHA1:f762303624f2464345b2da85523b503faa7c2fe4)

esort.js (1811B SHA1:e824ab9708c60a6ab924245a47847b2b0aa31687)

etree-1.0.tar.gz (3720B SHA1:c1422cdf85b4548acae848fd8d2c275d37e96ae2)