zbalkan’s gists

zbalkan / Get-Dcom10016Report.ps1

Created October 29, 2026 19:51

Triage DCOM Event ID 10016 (0x2720): classify each distinct case, rate its severity and give case-specific remediation.

	#Requires -Version 5.1
	<#
	.SYNOPSIS
	Triage DCOM Event ID 10016 (0x2720): classify each distinct case, rate its severity and give case-specific remediation.

	.DESCRIPTION
	Reads Microsoft-Windows-DistributedCOM 10016 events from the live System log,
	de-duplicates them into cases keyed by CLSID, AppID, requesting SID, locality and right, and enriches
	each case with the local COM registration:

zbalkan / Import-CbsLog.ps1

Created October 2, 2026 13:17

Imports and structurally normalizes relevant Windows CBS log entries for SFC and permission-related analysis, returning typed PowerShell objects suitable for filtering, correlation, and further processing.

	#Requires -Version 5.1

	<#
	.SYNOPSIS
	Imports relevant SFC and permission findings from a CBS log.

	.DESCRIPTION
	Import-CbsLog reads a single Windows Component-Based Servicing (CBS) log
	and writes relevant System File Checker (SFC) and permission-related
	entries to the PowerShell success output stream as typed CbsLogRecord

zbalkan / list_cases.sh

Created April 16, 2025 17:09

Lists all user-defined views in the shared DuckDB database.

	#!/usr/bin/env bash

	set -o errexit
	set -o nounset
	set -o pipefail

	cd "$(dirname "$0")"

	db_file="investigations.db"

zbalkan / create_view.sh

Last active May 11, 2025 16:39

Creates a case-specific DuckDB view over compressed .json.gz log files matching a given date pattern.

	#!/usr/bin/env bash

	set -o errexit
	set -o nounset
	set -o pipefail

	if [[ "${TRACE-0}" == "1" ]]; then
	set -o xtrace
	fi

zbalkan / block retweeters.js

Last active April 4, 2025 08:21

Block retweeters of a post

	// Twitter (or what’s left of it — X) someimes gives headaches.
	// I used the script of Isaac King at https://outsidetheasylum.blog/twitter-blocker/ at the beginning.
	// But the HTTP 428 is a headache. At first I added some random latency one each and every 10th action.
	// Then I blocked the queries to the bottlenecks like avatar loading API.
	// Now, it is harder to get blocked by Twitter's rate limiting.

	// Usage
	// Pick the tweet you want to block th RTers.
	// On the menu at the righthand side, click "View post engagements"
	// Navigate to "Reposts" tab

zbalkan / csv-viewer.html

Last active March 24, 2025 15:56

Single-page CSV viewer with search and sort options. It can be used for basic report generation over scripts.

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<title>CSV Table Viewer</title>
	<style>
	body {
	background-color: #3e94ec;
	font: 18px/28px -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
	font-size: 16px;

zbalkan / sysmonconfig.xml

Created February 25, 2025 09:38

Sysmon configuration by @Neo23x0, fine-tuned for Wazuh usage.

	<!--
	Since Wazuh File Integrity Monitoring (FIM) overlaps with some sysmon capabilities, it is better to fine-tune Sysmon configuration.
	Another aspect would be to diable Wazuh FIM and rely on Sysmon. That is not covered here.
	-->

	<!--
	sysmon-config \| A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
	Source version: 74 \| Date: 2021-07-08
	Source project: https://github.com/SwiftOnSecurity/sysmon-config
	Source license: Creative Commons Attribution 4.0 \| You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.

zbalkan / sysmonconfig.xml

Last active February 23, 2025 17:43

Sysmon configuration by @olafhartong, fine-tuned for Wazuh usage.

	<!--
	Since Wazuh File Integrity Monitoring (FIM) overlaps with some sysmon capabilities, it is better to fine-tune Sysmon configuration.
	Another aspect would be to diable Wazuh FIM and rely on Sysmon. That is not covered here.
	-->

	<!-- NOTICE : This is a balanced generated output of Sysmon-modular with medium verbosity -->
	<!-- due to the balanced nature of this configuration there will be potential blind spots -->
	<!-- for more information go to https://github.com/olafhartong/sysmon-modular/wiki -->
	<!-- -->
	<!-- // *// -->

zbalkan / sysmonconfig.xml

Last active March 14, 2026 13:50

Sysmon configuration by @SwiftOnSecurity, fine-tuned for Wazuh usage.

	<!--
	Since Wazuh File Integrity Monitoring (FIM) overlaps with some sysmon capabilities, it is better to fine-tune Sysmon configuration.
	Another aspect would be to diable Wazuh FIM and rely on Sysmon. That is not covered here.
	-->
	<!--
	sysmon-config \| A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
	Source version: 74 \| Date: 2021-07-08
	Source project: https://github.com/SwiftOnSecurity/sysmon-config
	Source license: Creative Commons Attribution 4.0 \| You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.

zbalkan / PsReadLineTest.ps1

Created November 3, 2024 20:50

PsReadLineTest.ps1

Set-Content -Path (Join-Path -Path $env:TEMP -ChildPath 'PsReadlineTest.txt') -Value 'Hello, world!'

Zafer Balkan zbalkan