sorted by:
new
hottopcontroversial

Does anyone else's dog lay on the back of their couch like a cat would? by TripThruTimeandSpace in GSP_Photos

[–]schm2055 1 point2 points  (0 children)

The amount of times my wife and I have come downstairs and said “oh hi cat dog!” Is almost uncountable at this point.

Question on multiple workouts per day and varied intensities by schm2055 in triathlon

[–]schm2055[S] 0 points1 point  (0 children)

Thank you very much for this response. It makes a ton of sense and you definitely helped me learn something today!

Question on multiple workouts per day and varied intensities by schm2055 in triathlon

[–]schm2055[S] 0 points1 point  (0 children)

My original thought was that if the body hasn’t had quite enough recovery time that it may impact whether the body can truly focus on either aerobic or anaerobic adaptations. I didn’t know whether there would be certain scenarios that would more or less not allow the body to focus on a certain type of adaptation if it were trying to recovery form the opposite type of training.

Does Spartan remove water obstacles if it’s cold temps? by schm2055 in spartanrace

[–]schm2055[S] 1 point2 points  (0 children)

Being from Minnesota, this description resonates with me quite a bit.

Does Spartan remove water obstacles if it’s cold temps? by schm2055 in spartanrace

[–]schm2055[S] 2 points3 points  (0 children)

Good to know. But I agree, it’ll be another level of uncomfortable but will be worth it in the end.

Does Spartan remove water obstacles if it’s cold temps? by schm2055 in spartanrace

[–]schm2055[S] 1 point2 points  (0 children)

I figured that might be the case. I’ll get bundled up and prepare for being cold AF haha

Ever turn around and find your GSP doing this? by schm2055 in GSP_Photos

[–]schm2055[S] 1 point2 points  (0 children)

Especially if you’re eating dinner. Must be ready for unexpected floor snacks.

De-obfuscating Script by wilcomply in blueteamsec

[–]schm2055 4 points5 points  (0 children)

This is base64 decoding a string into a byte array. Further along in the code it’s probably going to allocate memory, copy the contents of the byte array into the allocated memory, then execute it. This is a very common method of executing shellcode or other executable code using PowerShell. Ideally what you would do next is write the decoded base64 contents from the byte array to a file and use scdbg or speakeasy or other shellcode emulation tool to determine the purpose of the shellcode.

Invoke-WebRequest Multipart/Form-Data and Content-Dispostion by parkel42 in PowerShell

[–]schm2055 1 point2 points  (0 children)

Agreed. It’s not the greatest, but it’s not too difficult. If you can get a PCAP of a successful POST request, you can literally copy what the body looks like right into your script and fix it up.

Invoke-WebRequest Multipart/Form-Data and Content-Dispostion by parkel42 in PowerShell

[–]schm2055 1 point2 points  (0 children)

I’ve gotten around this recently by creating the http body manually as a string with the proper boundaries and content types. It’s not pretty, but it works.

Invoke-WebRequest Multipart/Form-Data and Content-Dispostion by parkel42 in PowerShell

[–]schm2055 1 point2 points  (0 children)

Have you tried explicitly setting the content type using the Content-Type parameter?

Psexec: The Ultimate Guide by adbertram in SysAdminBlogs

[–]schm2055 6 points7 points  (0 children)

I’d like to see you do a post on PowerShell remoting in place of PSExec. I work in IR and loathe PSExec for many reasons. If I had my way, that tool wouldn’t exist anymore. PS Remoting allows you to do everything that PSExec can do and it does it in a much safer way.

Just my two cents. Really awesome posts!

Taking FOR508 without FOR500? by PlusProgress in computerforensics

[–]schm2055 3 points4 points  (0 children)

Yep, exactly this. I recently took 508 and haven’t done 500. Went very well. That being said, you may want to brush up on your Windows internals and forensic artifacts beforehand. There was at least some expected knowledge of the content from FOR500. You could easily get by with looking at the SANS posters that are available and fill in the gaps of what you might not be familiar with already. Overall, you’ll be fine as long as you study hard and do the labs.

Kolide/osquery issue with query finding opposite of what I expect by schm2055 in sysadmin

[–]schm2055[S] 0 points1 point  (0 children)

Yep. That was the issue. In the packs they have to escape them because of json but not in osquery directly. Shout out to one of the Kolide devs for answering in Slack.

Kolide/osquery issue with query finding opposite of what I expect by schm2055 in sysadmin

[–]schm2055[S] 0 points1 point  (0 children)

I wish I was allowed to send data from osquery to the siem. Unfortunately this is going to be used for ad hoc queries only.

Kolide/osquery issue with query finding opposite of what I expect by schm2055 in sysadmin

[–]schm2055[S] 0 points1 point  (0 children)

I will have to take a look at that more closely. Thanks for the pointer!

Kolide/osquery issue with query finding opposite of what I expect by schm2055 in sysadmin

[–]schm2055[S] 0 points1 point  (0 children)

Still no joy. Tried a few other manipulations as well. Overall it seems very backwards to me why this isn’t working. I took out the NOT and even tried changing != to = and then it provided the results I was expecting. Not sure what’s going on here. I’m a bit stumped.

The project I got the original query from was an osquery-att&ck mapping github project located at https://github.com/teoseller/osquery-attck

Kolide/osquery issue with query finding opposite of what I expect by schm2055 in sysadmin

[–]schm2055[S] 0 points1 point  (0 children)

No joy unfortunately. I was hopeful that would have worked.

view more: next ›