Tools

All the useful tools interesting to be used

DFIR tools:

Malware Analysis and Reverse Engineer:

Unpackers/Obfuscators

Helpful links

Helpful Commands

for f in */Logs/*.evtx ; do echo "$f" ; mkdir -p $(echo "./Events/$f" | awk -F '/' '{print $1 "/" $2 "/" $3 "/" $4 "/"}') ; evtx_dump.py "$f" > "./Events/${f%.xml}.xml" ; echo " Done ..." ; done

this command will read all evtx files on */Logs/ folders and convert them into xml files under the folder ./Events with same directories from the original one.

for f in */Logs/*.evtx ; do echo "$f" ; mkdir -p $(echo "./Events/$f" | awk -F '/' '{print $1 "/" $2 "/" $3 "/" $4 "/"}') ; test ! $(wc -c "$f" | awk '{print $1 }' ) -le 550000000; $([[ $? -eq 1 ]] && evtx_dump.py "$f" > "./Events/${f%.xml}.xml") ; echo " Done ..." ; done

Same command but, this will check the file size not more than 550000000 bytes

fast command:

for f in ./*.evtx ; do echo "$f" ; evtx_dump.py "$f" > "./Events/${f%.xml}.xml" ; echo " Done ..." ; done

copy files and show the progress

rsync -r --info=progress2 source destination

Extract VBA macro from a list of document files

for f in * ; do echo "$f" ; mkdir -p $(echo "./output/$f") ; officeparser --extract-macros $f -o "./output/$f" ; echo " Done ..." ; done

How to use xargs to do multiprocessing commands:

find ./ -name '*.log' | xargs -rtP 20 -L1 grep "pattern" > output.txt

-P 20: number of processes at the same time

-t: print the command

-r: run only if there is argument

-L1: one argument at the same time, means one file per command

Note: if you use -L1 and write output on text file, the result might be missed up, so it is better not using it if there are many input files

How to set Linux Forwarder machine from one interface to another

modprobe iptable_nat

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -d 0/0 -s 10.0.1.0/24 -j MASQUERADE

iptables -A FORWARD -s 10.0.1.0/24 -d 0/0 -j ACCEPT

iptables -A FORWARD -s 0/0 -d 10.0.1.0/24 -j ACCEPT

If one use zgrep just like you use grep. If many:

find -iname "*.gz" | xargs zgrep <options like -P or -i ...> "<str or regex if using -P>"