Awesome List Updates on Jul 11, 2024

14 awesome lists updated today.

🏠 Home · 🔍 Search · 🔥 Feed · 📮 Subscribe · ❤️ Sponsor

1. Awesome Zsh Plugins

Plugins / superconsole - Windows-only

• zenv (⭐2) - Isolated working shell enviornments per directory (like direnv, but uses a new shell instance to provide cleaner isolation).

2. Magictools

Engines and Frameworks / Voxel Editors

• 🎉 Supernova Engine - Cross-platform game engine for 2D and 3D projects with entity component system (ECS) and data-oriented design in C++ and Lua.

3. Topics

List of press release contents

• Magazine launch - Wikimint luanches business resources related magazine.

List of articles and posts

• Secrets of inner piece - Unlocking the Secrets of Mindfulness: A Journey to Inner Peace

List of important bookmarks

• Case converter - Transform your text effortlessly with our advanced Case Converter tool

4. Awesome Quant

Python / Sentiment Analysis

• Asset News Sentiment Analyzer (⭐176) - Sentiment analysis and report generation package for financial assets and securities utilizing GPT models.

5. Awesome Python Typing

Backports and improvements

• typing-extensions (⭐507) - Backported and experimental type hints.

6. Awesome Malware Persistence

Techniques / Generic

• MITRE ATT&CK tactic "TA0003 - Persistence" - MITRE ATT&CK tactic "TA0003 - Persistence".

• forensic artifact repository (⭐1.1k) - Forensic artifact repository covers persistence techniques in their artifacts.

• Sigma rules (⭐9.4k) - Sigma rules which covers persistence techniques. You can even use filters such as --filter tag=attack.persistence or specifically for one technique tag=attack.t1084.

Techniques / Linux

• Linux Malware Persistence with Cron - Blog post about linux persistence using cron jobs.

• Linux Persistence Techniques - List of persistence techniques.

• Linux Red Team Persistence Techniques - List of persistence techniques.

• ebpfkit (⭐802) - Rootkit leveraging eBPF.

• TripleCross (⭐1.9k) - Rootkit leveraging eBPF.

Techniques / macOS

• theevilbit's series "Beyond the good ol' LaunchAgents" - List of macOS persistence beyond just the LaunchDaemons or LaunchAgents.

• KnockKnock (⭐560) - A persistence detection tool for macOS to scan for persistence mechanisms on macOS. Specific persistence locations are found in the plugins (⭐560) folder, e.g. LaunchItems (⭐560) or StartupScripts (⭐560).

• PoisonApple (⭐226) - Learn about various macOS persistence techniques by looking at the source code of PoisonApple.

• How malware persists on macOS - List of macOS persistence mechanisms.

Techniques / Windows

• Hexacorn's blog - Hexacorn's blog category for persistence category including the series "Beyond good ol' Run key".

• Autoruns - You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are scanned.

• PowerShell implementation of Autoruns (⭐275) - Another way to find Windows persistence locations is to look at the source code of the PowerShell version of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns version is found at the end of the module file too, which is so awesome!

• Common malware persistence mechanisms - Different persistence mechanisms for different vectors are described.

• Malware persistence techniques - Good summary of multiple persistence mechanisms, ranging from multiple registry keys to more advanced one, like COM hijacking.

• Detecting & Removing an Attacker's WMI Persistence - Blog post about detecting and removing WMI persistence.

• Windows Persistence using WinLogon - Blog post about abusing WinLogon.

• Untangling Kovter's persistence methods - Blog post about Kovter's persistens methos, among others, hiding in registry. Another one is Threat Spotlight: Kovter Malware Fileless Persistence Mechanism.

• Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exe - Blog post about abusing GlobalFlag for process execution.

• Uncovering a MyKings Variant With Bootloader Persistence via Managed Detection and Response - Blog post about bootloader persistence.

• Various blog posts about COM/CLSID hijacking
  • COM Object hijacking: the discreet way of persistence, 2014
  • Persistence – COM Hijacking, 2020
  • Abusing COM hijacking in combination with scheduled tasks, 2016

• Hunting for persistence via Microsoft Exchange Server or Outlook - Blog post about Microsoft Exchange server persistence.

Techniques / Cloud

• Shadow Linking: The Persistence Vector of SaaS Identity Threat - Abuse of additional identity providers to persist in an environment.

Techniques / Firmware

• MoonBounce: the dark side of UEFI firmware - An in-depth write up about one particular UEFI bootkit.

Persistence Removal / Generic

• Awesome Incident Response (⭐8.3k) - Use the tools and resources for security incident response, aimed to help security analysts and DFIR teams.

Persistence Removal / Windows

• PowerSponse (⭐38) - PowerSponse includes various commands for cleanup of persistence mechanisms.

• Removing Backdoors – Powershell Empire Edition - Various blog posts handle the removal of WMI implants.

• RegDelNull - Removal of registry keys with null bytes - used e.g. in run keys for evasion.

Detection Testing / Generic

• Atomic Red Team (⭐11k) - Atomic Red Team supports also the MITRE ATT&CK persistence techniques, see e.g. T1044 "File System Permissions Weakness" (⭐11k).

Prevention / macOS

• BlockBlock (⭐698) - A tool which provides continual protection by monitoring persistence locations and protects them accordingly. Similar to KnockKnock but for blocking.

Collection / Generic

• Awesome Forensics (⭐4.4k) - Use the tools from this list which includes awesome free (mostly open source) forensic analysis tools and resources. They help collecting the persistence mechanisms at scale, e.g. by using remote forensics tools.

• osquery - Query persistence mechanisms on clients.

• OSSEC (⭐4.8k) - Use rules and logs from the HIDS to detection configuration changes.

Collection / macOS

• KnockKnock - A tool to uncover persistently installed software in order to generically reveal such malware. See GitHub repository too for the source code (⭐560).

• Dylib Hijack Scanner or DHS - A simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. See GitHub repository too for the source code (⭐97).

Collection / Windows

• AutorunsToWinEventLog.ps1 (⭐1.3k) - Instead of using CSV output and copy these file to the server, you can use the AutorunsToWinEventLog script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding.

• PowerShell Autoruns (⭐275) - A PowerShell version of Autoruns.

• PersistenceSniper (⭐2k) - Powershell module to hunt for persistence implanted in Windows machines.

• RegRipper - Extracts various persistence mechanisms from the registry files directly.

• RECmd (⭐150) - Extract various persistence mechanisms, e.g. by using the config file UserClassesASEPs (⭐150) to extract user's CLSID information.

• KAPE - The tool allows collecting various predefined artifactgs using targets and modules, see KapeFiles (⭐747) which include persistence mechanisms, among others there's a collection of LNK files (⭐747), scheduled task files (⭐747) and scheduled task listing (⭐747) or a WMI repository auditing (⭐747) module.

7. Awesome Generative Deep Art

Text-to-speech (TTS) and avatars / Deforum

• p0n1/epub_to_audiobook (⭐1.6k): EPUB to audiobook converter, optimized for Audiobookshelf

8. Awesome Mysql

Deployment

• MariaDB4j (⭐877) - A Java launcher to run MariaDB without installation or external dependencies.

9. Awesome Geojson

editors & viewers

• play.placemark.io: web-based editor, supports many filetype imports & exports, operations

10. Awesome Java

Web Frameworks / Mocking

• Vaadin - Full-stack open-source Java framework that simplifies web app development. Build complex, interactive applications with Java alone, and enhance with TypeScript and React components, without needing deep JavaScript, CSS, or HTML expertise.

11. Awesome Polars

Talks and videos / Miscellaneous

• Polars basics playlist - A playlist that introduces the basic features of Polars in an instructive way.

12. Awesome Angular

Mixed utilities / Google Developer Experts

• angular-kit (⭐5) - A set of powerful Angular tools including pipes, lifecycle hooks, and reactive enhancements.

13. Awesome Rust

Applications / Security tools

• observer_ward (⭐1.5k) - Web application and service fingerprint identification tool

14. Awesome Agi Cocosci

Communications / Non-Verbal Communication

• Iconicity: From sign to system in human communication and language - Pragmatics & Cognition, 2014. [All Versions]. This paper explores the role of iconicity in spoken language and other human communication systems.

• Prev: Jul 12, 2024
• Next: Jul 10, 2024