Avi's blog

 Probably the target host that you are scanning do not respond to icmp echo ping request. It may think that someone launch an attack against itself. So the host firewall on the target system may blocking what Nessus wants to do.  So here are the steps you can do: Go to nessus > select the host and choose configure. Select the scan type as custom instead of port scan (common or all ports). Now go to host discovery and turn off the ping the remote host. Hopefully your scan should work now. Thanks Mahim Avi.

Kali linux mouse disappear issue fix 1. Shut down the VM. 2. Select Upgrade this virtual machine (right under Edit virtual machine settings) 3. Choose Next. 4. For Hardware Compatibility, choose Workstation 17.5 or later. 5. Choose Alter this virtual machine. 6. Choose Finish. 7. Power on the VM. Problem solved. Avi

 Base64 decode command. Go to sans sift workstation: echo "base64 payload data" | base64 -d | iconv -f UTF-16LE -t UTF-8 iconv command is used to convert double-byte Unicode to single-byte Unicode or ascii, making the output easier to read.  Avi

 Setting up plaso on your own windows host using wsl distro- windows subsystem for linux. First go to your linux vm and run below commands: docker must be installed on your linux vm. docker run -t --name Plaso-v20230520 log2timeline/plaso:20230520 log2timeline.py --version Link for plaso tags: If you want to pull latest docker image then from the below link find the relative tags. Here we are pulling 20230520 plaso version.  https://hub.docker.com/r/log2timeline/plaso/tags Making the .tar file that will be moved to windows vm. docker export Plaso-v20230520 > /cases/Plaso-v20230520.tar Now you can remove it from linux vm. docker rm Plaso-v20230520 Now take it to windows vm. Then open command prompt in admin mode and run below commands: mkdir C:\SANS\Plaso-v20230520 wsl --import Plaso-v20230520 C:\SANS\Plaso-v20230520 .\Plaso-v20230520.tar Avi

 EvtxECmd - this tool will help us to convert event logs into csv format. Later we can use timeline analysis tool to analysis the csv data more efficiently.  This tool also help us to convert logs into json format.  Download the tool first. https://ericzimmerman.github.io/#!index.md Command : evtxecmd --sync evtxecmd -f E:\C\Windows\System32\winevt\logs\Security.evtx --csv g:\Labs\event-logs --csvf security.csv evtxecmd -f "e:\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%40Operational.evtx" --csv G:\Labs\event-logs --csvf taskscheduler.csv Windows have so many event logs and so many event id's. Not all the event id's are important. Of course you can use your own but Mark Hallman created a script that will parse all the important event id's that is discussed in SANS FOR508 course. You can use mark hallman's Process-EventLogs.ps1 tool that will parse important event id's from bulk event logs leveraging evtxecmd tool.  https://github.com/ma...

 Kape is a triage collection and post-processing application written by Eric Zimmerman. Remember its just the triage collection tool ok? We will analyze the collection later.  https://github.com/EricZimmerman/KapeFiles Kape download: Kroll Artifact Parser And Extractor (KAPE) | Cyber Risk | Kroll Besides full disk image/acquired disk image, this tool allows us to create smaller triage image where important forensic data is present . In case the scenario is divide and conquer , meaning if you want smaller triage image from big size disk image then you can use this and share with your DFIR team to investigate together. The main reason of using kape is now you don't need to wading or sift through into the full image where 10% actual artifacts are present. Kape will allow you to collect those 10% before taking full image. Now you can analysis those 10% of data.  If you want to learn more, please open for508 workbook and labs section 1-2.pdf file and look for page 28. This is...