Helpful scripts - Revision history

Sam at 19:35, 3 April 2025

2025-04-03T19:35:41Z

Sam at 19:34, 3 April 2025

2025-04-03T19:34:40Z

Sam: /* Carve a File in Truxton */

2024-09-11T20:54:09Z

Carve a File in Truxton

Sam: /* Carve a File in Truxton */

2023-08-17T23:55:47Z

Carve a File in Truxton

Sam: /* E01 of E01s */

2023-08-17T23:55:32Z

E01 of E01s

Sam: /* Carve a File in Truxton */

2023-05-22T10:41:46Z

Carve a File in Truxton

Sam: /* Convert Excel Search Terms to Yara Rules */

2023-01-26T22:55:17Z

Convert Excel Search Terms to Yara Rules

Sam: /* Convert Excel Search Terms to Yara Rules */

2023-01-26T22:52:29Z

Convert Excel Search Terms to Yara Rules

Sam at 22:31, 26 January 2023

2023-01-26T22:31:44Z

Sam at 17:02, 22 September 2022

2022-09-22T17:02:30Z

@@ Line 149: / Line 149: @@
 This will produce a yara rule:
-<source lang="yara">
+<source lang="text">
 rule Search_Terms
+{
@@ Line 171: / Line 171: @@
 You can change the name of the rule if you'd like to "FulsomSlang" which is better.
 You can include more tags if you'd like by adding them to the rule line:
-<source lang="yara">
+<source lang="text">
 rule FulsomSlang : drugs
 </source>
 Now when any term in the rule is found, the file will be tagged with "FulsomSlang" and "drugs"

@@ Line 42: / Line 42: @@
 <source lang="powershell">
 function ping-it($name, $machine_name)
+{
@@ Line 94: / Line 93: @@
 In this example, we will copy the SYSTEM [https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry registry] file so we can play with it.
 Using Microsoft's [https://docs.microsoft.com/en-us/windows/win32/vss/vshadow-tool-examples#copying-a-file-from-a-shadow-copy vshadow] tool, we can do the following:
-<source lang="cmd">
+<source lang="bat">
 "C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\vshadow.exe" -p -nw -script=SETVAR1.cmd c:
 call SETVAR1.cmd

@@ Line 110: / Line 110: @@
 import truxton
-def main():
+def main() -> None:
   t = truxton.create()

@@ Line 118: / Line 118: @@
 if __name__ == "__main__":
-     main()
+     sys.exit(main())
 </source>

@@ Line 35: / Line 35: @@
 if __name__ == "__main__":
-     main()
+     sys.exit(main())
 </source>

@@ Line 103: / Line 103: @@
 =Carve a File in Truxton=
-If you need to carve the contents of a file in Truxton, you can send a message to the carver ETL to do it.
+If you need to carve the contents of a file in Truxton, you can send a message to the [[Carve|carver]] ETL to do it.
 <source lang="python">

@@ Line 125: / Line 125: @@
 ==Description==
-This script was written for a customer who maintained Excel spreadsheets with dictionaries of slang terms.
+This script was written for a customer who maintained [https://www.microsoft.com/en-us/microsoft-365/excel Excel] spreadsheets with dictionaries of slang terms.
 We converted his spreadsheets into a series of [https://virustotal.github.io/yara/ Yara] rule files for easy tagging.

← Older revision		Revision as of 22:52, 26 January 2023
Line 122:		Line 122:

	=Convert Excel Search Terms to Yara Rules=		=Convert Excel Search Terms to Yara Rules=
−	The <code>Excel2Yara.ps1</code> script, available on [https://github.com/SammyB428/Truxton-Samples/blob/main/Scripts/Excel2yara.ps1 GitHub]	+	The <code>Excel2Yara.ps1</code> [https://docs.microsoft.com/en-us/powershell/ PowerShell] script, available on [https://github.com/SammyB428/Truxton-Samples/blob/main/Scripts/Excel2yara.ps1 GitHub], will convert a column of terms to [https://virustotal.github.io/yara/ Yara] rules.
		+
		+	==Description==
		+	This script was written for a customer who maintained Excel spreadsheets with dictionaries of slang terms.
		+	We converted his spreadsheets into a series of [https://virustotal.github.io/yara/ Yara] rule files for easy tagging.
		+
		+	==Command Line==
		+	Given a spreadsheet with 5 cells:
		+	{\| class="wikitable"
		+	\|-
		+	! Term
		+	\|-
		+	\| Bob
		+	\|-
		+	\| Carol
		+	\|-
		+	\| Ted
		+	\|-
		+	\| Alice
		+	\|}
		+
		+	<source lang="powershell">
		+	PS C:\> .\Excel2Yara.ps1 SearchTerms.xlsx 1 >MySearchTerms.yara
		+	</source>
		+
		+	Here we told the script which column contains the terms (column one) and we redirected the output to a file.
		+
		+	This will produce a yara rule:
		+	<source lang="yara">
		+	rule Search_Terms
		+	{
		+	meta:
		+	description = "Search terms from C:_SearchTerms.xlsx (last modified 1/26/2023). This file was generated 1/26/2023"
		+	strings:
		+	$term1 = "Bob"
		+	$term2 = "Carol"
		+	$term3 = "Ted"
		+	$term4 = "Alice"
		+
		+	condition:
		+	any of them
		+	}
		+	</source>
		+
		+	Put a reference to the <code>MySearchTerms.yara</code> file in the <code>C:\ProgramData\Truxton\Truxton.yara</code> and it will be used to scan the next file flowing through Truxton during a load.
		+
		+	==Tagging==
		+	Any file that contains any of the terms in the sample will be tagged with "Search_Terms" which is minimally useful.
		+	You can change the name of the rule if you'd like to "FulsomSlang" which is better.
		+	You can include more tags if you'd like by adding them to the rule line:
		+	<source lang="yara">
		+	rule FulsomSlang : drugs
		+	</source>
		+
		+	Now when any term in the rule is found, the file will be tagged with "FulsomSlang" and "drugs"

← Older revision		Revision as of 22:31, 26 January 2023
Line 120:		Line 120:
	main()		main()
	</source>		</source>
		+
		+	=Convert Excel Search Terms to Yara Rules=
		+	The <code>Excel2Yara.ps1</code> script, available on [https://github.com/SammyB428/Truxton-Samples/blob/main/Scripts/Excel2yara.ps1 GitHub]

← Older revision		Revision as of 17:02, 22 September 2022
Line 101:		Line 101:

	The above will copy the system registry file to <code>C:\temp\SYSTEM.reg</code>		The above will copy the system registry file to <code>C:\temp\SYSTEM.reg</code>
		+
		+	=Carve a File in Truxton=
		+	If you need to carve the contents of a file in Truxton, you can send a message to the carver ETL to do it.
		+
		+	<source lang="python">
		+	import sys
		+	sys.path.append('C:/Program Files/Truxton/SDK')
		+	import truxton
		+
		+	def main():
		+
		+	t = truxton.create()
		+	t.carvefile("63204cfc-83a3-c8bc-b85d-392d0000000d")
		+
		+	return None
		+
		+	if __name__ == "__main__":
		+	main()
		+	</source>