Redscale is a repository for Threat Intel indicators.

It is based on the STIX 2.1 format.
Redscale enables ingestion of single or bulk indicators using a web form, or by uploading a STIX JSON file.
Indicators can be exported in Splunk ES Threat Intelligence CSV format for upload into Splunk.
Redscale is a web server PowerShell script that runs on vanilla Windows, access is via a web browser.

• id - A unique identifier for the object.
• Collection - A unique identifier for a single/group of reports/indicators.
• Report - A unique identifier for a single/group of indicators.
• type - The type of object/indicator.
• object_refs - A list of identifiers to link objects together.
• created_by_ref - A unique identifier for the creator of the object, possibly source vendor.
• created - Timestamp of when the object was created.
• modified - Timestamp of when the object was last modified.
• published - Timestamp of when the report was published.
• object_marking_refs - Traffic Light Protocol (TLP) marking that provides context about the object's usage restrictions.
• confidence - The degree of certainty that an indicator is malicious.
• name - A human-readable name for the object.
• description - A description of the object and why it's relevant.
• pattern - A STIX pattern that specifies the conditions for detecting the indicator.
• valid_from - Timestamp indicating when the object is expected to be valid.
• Valid Days - The number of days the object is valid for after it becomes valid.
• Sharing - Who the object can be shared with.
• Comments - Comments
• Splunk 1 - domain_intel: domain | email_intel: src_user | file_intel: file_hash | http_intel: url | ip_intel: ip | process_intel: process | registry_intel: registry_path | service_intel: service | user_intel: user | certificate-intel: certificate_serial (The Splunk column the indicator needs to be mapped to depending on the type.)
• Splunk 2 - email_intel: subject | file_intel: file_name | http_intel: http_user_agent | process_intel: process_file_name | registry_intel: registry_value_name | service_intel: service_file_hash | certificate-intel: certificate_issuer#certificate_issuer_organization#certificate_issuer_unit (The Splunk column the indicator needs to be mapped to depending on the type.)
• Splunk 3 - http_intel: http_referrer | registry_intel: registry_value_text | service_intel: service_dll_file_hash | certificate-intel: certificate_subject#certificate_subject_organization#certificate_subject_unit (The Splunk column the indicator needs to be mapped to depending on the type.)
• Notify - Send email if the indicator is detected in Splunk.
• Retro - Perform a retrospective search from the indicator's valid_from timestamp.

Note: Lowercase field names are taken from the STIX 2.1 specification.

1. Start Windows PowerShell - Run as Administrator
2. One-Time execute command: Set-ExecutionPolicy RemoteSigned
3. Extract redscale.zip, change to redscale folder.
4. Execute command: .\redscale.ps1

• Redscale 3.0.0: redscale-3.0.0.zip (78540B SHA1:bdb0f61ad96968c7d93decff43491527a79edf4d)

PacketZero is a 3D network monitor, displaying hosts and packet traffic. Features include support for multiple sensors (sensor0), analysis of packets to gather hostnames and services, configurable layout of subnetworks, recording/replaying of packet traffic, and the ability to filter packets by hosts, protocol or port.

sensor0 is a packet capture agent which reads and sends packet header information to PacketZero, locally or remotely. sensor0 also equates hostname to IP by reading DNS packets (UDP type A class IN standard query response). Multiple sensors can send information to multiple computers running PacketZero on the same subnet via broadcast.

• PacketZero Source 1.0.3: PacketZero-1.0.3.tar.gz (45782B SHA1:5b19647cf923858ba8733eb33bcc94e39ebeca9b)
• sensor0 Source 1.0.2: sensor0-1.0.2.tar.gz (6714B SHA1:1b2caf03c26195b062e52d75b87c1c1b55861505)
• sensor0 Simulator 0.1: sensor0-sim.py (1288B SHA1:d735b911cd456d0d73cb7f047a72bbbd01c68959)
• PacketZero man page 26 May 16: packet0.1
• sensor0 man page 26 May 16: sensor0.1
• PacketZero README 26 May 16: PacketZero_README.txt

• 3-Button Scroll Mouse
• OpenGL Support

• sensor0 requires libpcap/WinPcap.
• PacketZero requires Simple DirectMedia Layer 2.0 (SDL2).
• Mac OS X: Download https://www.libsdl.org/tmp/release/SDL2-2.0.4.dmg, put SDL2.framework in /Library/Frameworks/

• Linux: Install g++, SDL2 (dev), libpcap (dev), compile using "compile-packet0.sh" and "compile-sensor0.sh" scripts.
• Mac OS X: Install Xcode, compile using "compile-packet0.sh" and "compile-sensor0.sh" scripts.
• Windows (sensor0 only): Install Visual Studio Community and WinPcap Developer Pack.

• Linux, Mac OS X:
• Put executables "packet0" and "sensor0" in /usr/local/bin/
• Put man pages "packet0.1" and "sensor0.1" in /usr/local/share/man/man1/
• These directories may have to be created.
• Firewall Configuration:
• By default, sensor0 talks to PacketZero via UDP port 6333.

Starting order does not matter, however if sensor0 is running and PacketZero is not, ICMP Port Unreachable (UDP port 6333) may be generated.

• Linux, Mac OS X:

  sensor0 [-i <interface/file>] [-s <id>] [-h <destination>] [-u <port>] [-p] [-d]
    -i <interface> - Listen on interface (en0, eth1, ppp0, wlan0, etc.); or
       <file> - Read packets from pcap file.  Standard input is used if file is "-".
    -s <id> - Identify packets from a specific sensor when multiple exist (1-255, default 1).
    -h <destination> - PacketZero IP or broadcast address (default localhost).
    -u <port> - PacketZero UDP port (default 6333).
    -p - Enable promiscuous mode.
    -d - Run as daemon.

• Omit "-i <interface/file>" to display an Interface List for selection.
• Capturing packets requires you start sensor0 as root.
• View syslog to assist troubleshooting.


• Windows:

  sensor0.exe [[[<id>] <destination>] <port>] [-p]
    <id> - Identify packets from a specific sensor when multiple exist (1-255, default 1).
    <destination> - PacketZero IP or broadcast address (default localhost).
    <port> - PacketZero UDP port (default 6333).
    -p - Enable promiscuous mode.

Created in directory:

• Linux: ~/.packet0/
• Mac OS X: ~/Library/Application Support/PacketZero/

Files:

• controls.txt - Controls
• packet0_prefs - Preferences
• 0network_0nl - Network Layout On-Exit
• 1network_0nl - Network Layout 1
• 2network_0nl - Network Layout 2
• 3network_0nl - Network Layout 3
• 4network_0nl - Network Layout 4
• netpos.txt - CIDR Notation Net Position/Colour
• traffic_0pt - Packet Traffic Record
• tmp_packet0 - Temporary Data

If a host is not a member of any net position entries, it is placed in the Grey Zone. If a host is a member of multiple net position entries, the first entry is used. Line format for net position entries is "pos net x-position y-position z-position colour", eg. "pos 123.123.123.123/32 10 0 -10 green".

Positions:

• Grey/Red - positive x-position
• Blue/Green - negative x-position
• Up - positive y-position
• Down - negative y-position
• Grey/Blue - positive z-position
• Red/Green - negative z-position

Colours:

• none (where multiple colours are used)
• default (grey)
• orange
• yellow
• fluro
• green
• mint
• aqua
• blue
• purple
• violet
• hold (place hosts in same position)

If sudo is required to start/stop a local sensor, the user starting sensor0 must be in /etc/sudoers. The default command to stop a local sensor is "killall sensor0", which will kill all sensor0 processes. Add the following to /etc/sudoers, replacing <user> with the required username:

  <user> ALL=(root) NOPASSWD: /usr/local/bin/sensor0
  <user> ALL=(root) NOPASSWD: /usr/bin/killall

Press H key in PacketZero to show controls.

• Support only for IPv4.
• IP headers with options are ignored.
• Support for packets with optionless GRE or VLAN 802.1Q encapsulation.
• By default hosts are added to PacketZero from packet source IP address, activate Add Destination Hosts to also add from destination IP address.
• Anomalies are a new host or host service.
• Clicking a host cluster will cycle through selecting hosts within.
• Using the menu options to move/arrange a few thousand hosts may take a few minutes.

Logalysis is a Security Information Manager with built-in log/pcap analysis tools.

The back-end is HTML/PHP/MySQL based (a simple LAMP server is required) with the clients connecting using Mozilla Firefox or Google Chrome browsers.
Incidents can be generated automatically from network events, or created from the real-time section which lists current events occurring in your network.
Displayed log entries can be dynamic, containing links to other data, to allow quicker analysis.
Generated pcaps can be broken into sessions and their text displayed using tcpflow, or Foremost can be used for data carving.
Logalysis is plug-in based allowing log, pcap, chart, and report generation to be customised to the appliances within your network. Plug-ins are simple to write allowing your security team to expand the system's capability.

• Apache2 (access.log)
• McAfee Network Security Manager (IPS events)
• Snort (IDS/IPS events)
• Solera (pcap generation)
• Sourcefire Defence Centre (IPS events)
• Sourcefire Defence Centre (RNA events)
• Squid (access.log)

• Logalysis 1.0.2: logalysis-1.0.2.tar.gz (364856B SHA1:c02856de354ba9c5698f6d832e640a5abfdb21ff)
• Logalysis Plug-ins 1.0.1: logalysis-plugins-1.0.1.tar.gz (2250975B SHA1:44aac7ef3d35b128fc7113bfc014fa04d243d89e)
• Logalysis README 27 May 16: Logalysis_README.txt

Some honeypot tools which you may find useful:

Laconic is a simple multi-threaded web server, which logs all requests for analysis. By default, it contains code for a web shell and ability to open a firewall port.

• Laconic 1.0.8: laconic.pl (16741B SHA1:ae6becb0415366110d51b7400602b9d85a626809)
• Laconic systemd: laconic.service

Laconic Log Splunk Field Extraction:

^(?:[^\s\n]*\s){3}(?P[^:]+):(?P\d+)\->(?P[^:]+):(?P\d+)\s(?P\d+)\s"(?P[^\s]+)\s(?P[^"]+)"\s"(?P[^"]+)"\s"(?P[^"]+)"\s"(?P[^"]+)"\s(?P\d{3})\s(?P\d+)?

Smurt acts like a SMTP MTA, which logs all transfers for analysis.

• Smurt 1.0.6: smurt.pl (6575B SHA1:48c9eff4d7e01c93522263a933244eba2c9ac936)
• Smurt systemd: smurt.service

Smurt Log Splunk Field Extraction:

^(?:[^\s\n]*\s){3}(?P[^:]+):(?P\d+)\->(?P[^:]+):(?P\d+)\s(?P\d+)\s"(?P[^"]+)"\s"(?P[^"]+)"\s"(?P[^"]+)"\s(?P\d+)?

Bluffer is a Network Service Imitator which attempts to extract the network activity from malware. Once the network activity of the malware is known, logs can be searched to determine if the malware has executed successfully, determine the scope of hosts infected, or observe the spread of the infection.

• ARP
• ICMP
• TCP
• UDP
• DNS
• NBNS
• DHCP Inform
• WPAD
• HTTP
• SMTP
• POP3
• IMAP
• TFTP
• FTP

Bluffer resides on a Ubuntu VM which is connected to a Windows VM (which the malware is run on) via a Host-only network. The default route for the Windows VM is the IP address of the Ubuntu VM.

• Bluffer 1.0.2: bluffer.cpp (21771B SHA1:a6edb8edee92bc560a34bf42ec4b07fe57ccc03c)

This is a project I did during COVID-19 to create a simple serverless managed e-commerce website solution.

• Easily customisable, it only requires:
1. A business name (or logo).
2. A background image (store photo).
3. "About" speal.
4. Location, contact, social media, delivery links (if applicable).
5. Item list (text layout can have sections, items, options, extras and notes).
• Website hosted for free on GitHub, with a TLS (HTTPS) certificate for data security.
• Stripe handles the secure payments by debit/credit card, Apple Pay and Google Pay.
• Customer access via a mobile/desktop browser, no app to install.
• No customer accounts required, no HTTP cookies, no user tracking.
• Customer's favorite item can be saved in a bookmark.

• eStore 1.0.3: estore-1.0.3.zip (1707623B SHA1:14a1025d116c0a57807e6c84e7b0851eaa47e1da)

Miscellaneous code which you may find useful:

gush.c (10637B SHA1:1efcde891c2b8152b779e8a01b33ec0a15e85fe4)

mirror.c (3718B SHA1:fb71518295020187c88aa7990970318f698d44ea)

edate.js (1845B SHA1:f762303624f2464345b2da85523b503faa7c2fe4)

esort.js (1811B SHA1:e824ab9708c60a6ab924245a47847b2b0aa31687)

etree-1.0.tar.gz (3720B SHA1:c1422cdf85b4548acae848fd8d2c275d37e96ae2)