shortstack

import json
import grpc
import app.libraries.pyvelociraptor
from app.libraries.pyvelociraptor import api_pb2
from app.libraries.pyvelociraptor import api_pb2_grpc


def query_endpoint_status(endpoint_id):
    status = query_vr(
        'SELECT last_seen_at as last_seen FROM clients() WHERE client_id="%s"'

shortstack

sudo apt-get update
sudo apt-get install ca-certificates curl gnupg -y
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

shortstack

systemctl stop velociraptor_server

rm -r /opt/vr_data/hunts/*
rm -r /opt/vr_data/hunt_index/*
rm -r /opt/vr_data/clients/*
rm -r /opt/vr_data/client_info/snapshot.json*

curl https://storage.googleapis.com/thvr-cdn/stacking_hunts.zip --output /opt/stacking_hunts.zip
unzip /opt/stacking_hunts.zip -d /opt/vr_data
chown velociraptor:velociraptor -R /opt/vr_data/hunts

shortstack

name: Windows.Applications.LimaCharlieInstall
author: Whitney Champion (@shortxstack)
description: |
  This artifact installs the LimaCharlie EDR sensor.

tools:
  - name: LimaCharlieBinary
    url: https://downloads.limacharlie.io/sensor/windows/64
    serve_locally: true

shortstack

import requests
import json
import time
from datetime import datetime, timedelta
import jwt 
import uuid 
from flask import Flask
from config import Config

shortstack

def generate_jwt():

    api_key = ""
    base_url = "https://jwt.limacharlie.io"
    uid = ""

    url = "%s?uid=%s&secret=%s" % (base_url, uid, api_key)

    try:
        r = requests.get(url)

shortstack

deploy_sysmon:
    detect:
      event: OS_SERVICES_REP
      op: and
      rules:
        - op: is platform
          name: windows
        - op: contains
          not: true
          case sensitive: false

shortstack

import json 
import yaml
import requests 

url = "https://sigma.limacharlie.io/convert/rule"

files = {'rule': open('sigma_rule.yml', 'rb').read()}

headers = {
  "Content-Type": "application/x-www-form-urlencoded"

shortstack

import os
import sys
import boto3
import pytz
from datetime import datetime,timedelta
from os import path

s3 = boto3.resource('s3')
s3_client = boto3.client('s3')

shortstack

#!/usr/bin/env python3
import socket
import sys
import json
import zlib
import copy
import base64
import re
import ssl
import logging