codesnips
bash 
#!/usr/bin/env bash
set -euo pipefail

find / -perm -4000 -type f 2>/dev/null | sort
sudo -l
find /etc/systemd/system -type f -writable 2>/dev/null

Linux privilege escalation checks for suspicious local state

privilege-escalation linux auditing
by Kai Nakamura 1 tab
plaintext 
http.response.code >= 400
tcp.analysis.retransmission
tls.alert_message
dns.flags.response == 1 && dns.a
ip.addr == 10.10.20.15 && tcp.port == 443

Wireshark display filters that speed up incident triage

wireshark packet-analysis incident-response
by Kai Nakamura 1 tab
bash 
#!/usr/bin/env bash
tcpdump -i eth0 host 10.10.20.15 -w suspect-host.pcap
tcpdump -i eth0 port 443 and host api.example.com
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0'

tcpdump filters for fast packet capture during investigations

tcpdump packets incident-response
by Kai Nakamura 1 tab
bash 
#!/usr/bin/env bash
set -euo pipefail

OUT="/tmp/incident-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUT"

Forensic collection script for volatile host evidence

forensics incident-response linux
by Kai Nakamura 1 tab
plaintext 
alert tcp $HOME_NET any -> $HOME_NET 445 (
  msg:"Possible SMB lateral movement enumeration";
  flow:to_server,established;
  content:"|FF|SMB"; depth:4;
  threshold:type both, track by_src, count 15, seconds 60;
  sid:1000001; rev:1;

Suricata IDS rule authoring for suspicious lateral movement

suricata ids detection
by Kai Nakamura 1 tab
plaintext 
rule SuspiciousDownloader {
  strings:
    $a = "powershell -enc" nocase
    $b = "Invoke-WebRequest" nocase
    $c = "http://" nocase
  condition:

YARA rules for spotting suspicious binaries during triage

yara malware triage
by Kai Nakamura 1 tab
bash 
#!/usr/bin/env bash
dnssec-keygen -a ECDSAP256SHA256 -b 2048 -n ZONE example.com
dnssec-signzone -A -3 $(head -c 32 /dev/urandom | sha256sum | cut -d' ' -f1) -N increment -o example.com db.example.com

DNSSEC zone signing basics for integrity of DNS answers

dnssec dns integrity
by Kai Nakamura 1 tab
bash 
#!/usr/bin/env bash
set -euo pipefail

certbot renew --quiet --deploy-hook "systemctl reload nginx"
openssl x509 -enddate -noout -in /etc/letsencrypt/live/example.com/fullchain.pem

TLS certificate automation with certbot and strict renewal checks

tls certificates certbot
by Kai Nakamura 1 tab
nginx 
server {
  listen 443 ssl;
  server_name internal-api.example.com;

  ssl_certificate /etc/nginx/tls/server.crt;
  ssl_certificate_key /etc/nginx/tls/server.key;

Mutual TLS between internal services with Nginx

mtls tls nginx
by Kai Nakamura 1 tab
ruby 
timestamp = request.headers.fetch('X-Signature-Timestamp')
signature = request.headers.fetch('X-Signature')
payload = request.raw_post

data = "#{timestamp}.#{payload}"
expected = OpenSSL::HMAC.hexdigest('SHA256', ENV.fetch('WEBHOOK_SECRET'), data)

HMAC signed API requests for webhook and partner integrity

hmac api-signing webhooks
by Kai Nakamura 2 tabs
plaintext 
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

SecRule ARGS|REQUEST_HEADERS|XML:/* "@detectSQLi" \
  "id:1001,phase:2,deny,status:403,log,msg:'Potential SQLi detected'"

ModSecurity WAF rules for common web attack patterns

waf modsecurity web-security
by Kai Nakamura 1 tab
ruby 
AuditLog.create!(
  actor_id: current_user.id,
  action: 'member.approve',
  target_type: 'Member',
  target_id: member.id,
  ip_address: request.remote_ip,

Structured audit logging for privileged actions

audit-logging siem observability
by Kai Nakamura 1 tab