In looking into compromised systems, often what is needed by incident responders and investigators is not enabled or configured when it comes to logging. To help get system logs properly Enabled and Configured, below are some cheat sheets to help you do logging well and so the needed data we all need is there when we look.
- Ap Lang Rhetorical Analysis Cheat Sheet
- Technical Analysis For Beginners
- Rhetorical Analysis Cheat Sheet
Cheat Sheets to help you in configuring your systems:
The Windows Logging Cheat SheetUpdated Feb 2019
The Windows Advanced Logging Cheat SheetUpdated Feb 2019
The Windows HUMIO Logging Cheat Sheet Released June 2018
The Windows Splunk Logging Cheat Sheet Updated Sept 2019
The Windows File Auditing Logging Cheat Sheet Updated Nov 2017
The Windows Registry Auditing Logging Cheat Sheet Updated Aug 2019
The Windows PowerShell Logging Cheat Sheet Updated Sept 2018
The Windows Sysmon Logging Cheat Sheet Updated Jan 2020
Attack Surface Analysis Cheat Sheet¶ What is Attack Surface Analysis and Why is it Important¶. This article describes a simple and pragmatic way of doing Attack Surface Analysis and managing an application's Attack Surface. View full document Fundamental Analysis Performing fundamental analysis on every company is of utmost importance before purchasing a stock of that company. So this cheat sheet will help you do just that. Profitability Ratios These ratios indicate the profitability of the company. Introduction The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics. These cheat sheets were created by various application security professionals who have expertise in specific topics.
MITRE ATT&CK Cheat Sheets
The Windows ATT&CK Logging Cheat Sheet Released Sept 2018
The Windows LOG-MD ATT&CK Cheat Sheet Released Sept 2018
The MITRE ATT&CK Logging Cheat Sheets are available in Excel spreadsheet form on the following Github:
Detail than a cheat sheet while still being short enough to serve as a quick reference. The PDF also contains links to external resources for further reference. Windows logging is a robust capability and exhaustive treatments of the topic are very hard to find. Two references that provide additional details are. Technical analysis is the art and science of reading price action on a chart. Here is a quick reference guide that can be used as a cheat sheet. A range bound market can be identified by horizontal upper resistance and horizontal lower support. When price breaks out of a trading range it can signal the potential for a new trend in price.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Update Log:
SysmonLCS:Jan 2020 ver 1.1
Fixed GB to Kb on log size
WSplunkLCS:Sept 2019 ver 2.22
Minor code tweaks, conversion
WSysmonLCS:Aug 2019 ver 1.0
Initial release
WRACS:Aug 2019 ver 2.5
Added a few more items
WSLCS:Feb 2019 ver 2.21
Fixed shifted box, cleanup only
WLCS:Feb 2018 ver 2.3
Added a couple items from Advanced
Adjust a couple settings
General Clean up
Referenced the Windows Advanced Logging Cheat Sheet
WALCS: Feb 2019 ver 1.2
Updated and added several items
WHLCS:June 2018 ver 1.0
Ap Lang Rhetorical Analysis Cheat Sheet
Initial release
WFACS: Oct 2016 ver 1.2
Added a few new locations
WRACS: oct 2016 ver 1.2
Added many autorun keys
Sorted the keys better
WSLCS:Mar 2018 ver 2.1.1
Fixed shifted box, cleanup only
WLCS:Jan 2016 ver 2.0
Added Event code 4720 - New user account created
Changed references to File and Registry auditing to point to the new File and Registry auditing Cheat Sheets
Expanded info on Command Line Logging
WRACS: Jan 2016 ver 1.1
Sort HKLM Keys
Added keys to monitor PowerShell and Command Line log settings
Updated HKCU and USERs.DEFAULT info
Added info about HKCU unable to be set in Security Templates
Added PowerShell script to set HKCU Registry Auditing
Technical Analysis For Beginners
Rhetorical Analysis Cheat Sheet
Key language & structural features | ||
Mr Birling “I’m talking as a hard-headed practical man of business” ‘you’ll hear some people say war is Inevitable … fiddlesticks!’ ‘The Titanic – she sails next week…and unsinkable, absolutely unsinkable.’ “I gather there’s a very good chance of a knighthood” “A man has to make his own way – has to look after himself – and his family too, of course” “(rather impatiently) Horrid business. But I don’t understand why you should come here.” “you’d think everybody has to look after everybody else, as if we were all mixed up like bees in a hive – community and all that nonsense.” “I was an alderman for years – and Lord Mayor two years ago – and I’m still on the Bench – so I know the Brumley police offers pretty well” “there’s every excuse for what your mother and I did” “Probably a Socialist or some sort of crank” “Now look at the pair of them- the famous younger generation who know it all. And they can’t even take a joke-” | Dramatic irony His language is also very dismissive when he says ‘Fiddlesticks!’ and ‘silly’ - he belittles other’s ideas. Exclamatory sentence – he’s passionate and convinced about what he’s saying. Titanic symbolises his own family – believes they are untouchable until the Inspector arrives giving them a rude awakening. His language changes when the Inspector arrives as he speaks in short, sharp fragments and uses lots of dashes. His language becomes more colloquial and 'common', such as 'y’know'. which conveys how his authority is breaking down. He often uses ‘I’ which conveys his selfish attitude, however, as the play continues he switches to the inclusive pronoun ‘we’ to diminish the scale of the problem (Eva’s death) and shift blame. He uses understatements like ‘it would be very awkward wouldn’t it?’ He uses euphemisms when referring to taboo subjects | Priestley uses Birling as a symbol of the callous and heartlessness of capitalism. Through his character he is criticizing the complacency of capitalist prosperity. He is representative of the older generation who were unwilling to change. However, he is presented as a realistic character by Priestley through his use of colloquial language appropriate for the time. Furthermore, he is described as ‘panic stricken’ this indicates that his defiance and bravado have finally been shattered and so Priestley lets the audience see someone who is so blindly wrong and never as really in control of events as he would like himself and others to think. Therefore the audience is invited to feel sympathy |
Mrs Birling “About fifty, a rather cold woman and her husband’s social superior” “girls of that class” ‘you know, my husband was Lord Mayor only two years ago and that he’s still a magistrate’ ‘I’m very sorry. But I think she only had herself to blame “I’ve done nothing wrong – and you know it.” “Go and look for the father of the child. It’s his responsibility.” “She was giving herself ridiculous airs…claiming elaborate fine feelings…that were simply absurd in a girl in her position.” “As if a girl of that sort would ever refuse money!” “I’m sorry she should have come to such a horrible end. But I accept no blame at all” “he ought to be dealt with very severely-…make sure that he’s compelled to confess in public his responsibility” ‘he certainly didn’t make me confess – I had done no more than my duty’ | The stage descriptions of her actions change as the pretence is revealed e.g. ‘grandly’ / ‘haughtily’/ ‘triumphantly’ become ‘rather cowed’/ ‘distressed’ ‘staggered’ / ‘alarmed’. Mrs Birling’s language is quite abrupt and dismissive: ‘that class’/ ‘that sort’/ ‘the type’. She believes she is morally and socially superior to them – she is a snob. Later in the play Mrs Birling’s language is broken up into fragments that don’t connect: ‘No-Eric-please’. The fragmented speech echoes the collapsing of self-confidence and complacency of these very comfortable, middle class, wealthy characters. This is more shocking because of the contrast with how they were at the start of the play. The dashes could also represent the break down in their relationship. Mrs Birling uses imperatives as she commands the Inspector and other characters which conveys her superiority, confidence and self-assurance. Puts on a pretence of respectability by her use of euphemisms: e.g. ‘a girl of that Class’ who has found herself in a ‘particular condition’ Use of imagery: Sheila warns her mother not to try and build up a kind of ‘wall’ – the wall being a symbol of a barrier/pretence | Priestley uses Mrs Birling to epitomize all that is wrong with society. She represents the social snobbery and hypocrisy of the upper classes and shows no remorse in her cruel treatment of Eva Smith. Priestley presents her as an absurd character that ironically passes her own social guilt onto her own son – condemning him. As a result, Priestley deals with Mrs Birling with special severity, having her fall into a trap of her own making: she is confronted with the knowledge that Eric is a hard drinker and the father of the dead woman’s child. She has helped to kill her own grandchild. It is only when she realises this does she begin to show any signs of weakening. Priestley shows us that we should not trust the wealthy members of society to tell the truth. |
Sheila Birling “A pretty girl in her early twenties, very pleased with life and rather excited” “Yes, go on, Mummy” “(rather distressed) I can’t help thinking about this girl- destroying herself so horribly- and I’ve been so happy tonight. Oh I wish you hadn’t told me.” “But these girls aren’t cheap labour- they’re people.” “She was a very pretty girl…that didn’t make it any better.” “I went to the manager and told him this girl had been very impertinent – and – and - ” “And if I could help her now, I would-” “I’ll never, never do it again to anybody…I feel now I can never go there again” “Why- you fool- he knows. Of course he knows. And I hate to think how much he knows that we don’t know yet. You’ll see. You’ll see.” “You mustn’t try to build up a kind of wall between us and that girl. If you do the Inspector will just break it down. And it’ll be all the worse when he does” “No, he’s giving us the rope- so that we’ll hang ourselves” Bitterly ”I suppose we’re all nice people now” “He inspected us all right.” “It frightens me the way you talk” | Sheila uses imagery when she talks of her mother’s attempts to ‘build up a kind of wall’; implying the metaphorical distance Mrs Birling creates between the classes. When Sheila warns the others that the Inspector is ‘giving us rope so that we hang ourselves’, she once again uses a metaphor to create a visual image of the way the Inspector skilfully manipulates characters into confessing their sins. Sheila’s language also reflects her increasing maturity as she begins the play saying “mummy” using a lot of personal pronouns to highlight her selfish, childlike attitude at the start of the play. As the play progresses she refers to Mrs Birling as “mother” which reflects this change and perhaps she doesn’t feel as intimate with her mother and has lost respect for her because of the way she is behaving. Sheila’s language becomes more passionate and she uses sarcasm (“So nothing’s happened, so there’s nothing to be sorry for, nothing to learn.”) Sheila also uses irony when she is appalled by her parents’ attitudes to carry on as before: “I suppose we’re all nice people now”. Sheila uses irony to show that she completely disagrees with her parents and that she understands the moral consequences of her actions. The use of irony highlights the tensions that existed between the younger Sheila and Eric are less restrained and their use of colloquial language (slang expressions) such as ‘squiffy’ which shock their parents and highlight the tensions between the generations. Sheila uses dramatic language “We killed her” Stage directions– she “shivers”, “tensely” - shows her fear Shows she becomes a bit like the Inspector – asking questions, contradicting her mother. Sheila significantly refuses to take back Gerald’s ring and interestingly she uses phrases reminiscent of the Inspector in her reply, “not yet” and “It’s too soon” which emphasizes the importance of timing – the telephone rings just after. | Priestley uses the character of Sheila to represent his own views of social responsibility. She offers hope for the future and Priestley uses Shelia as an example of people’s changing attitudes towards those less fortunate than themselves. She is sympathetic towards Eva and other girls in her position, recognising that they were “not just cheap labour but people”. She accepts that her actions impacted on Eva’s life and that she cannot disconnect her actions from the effects these have on others. She recognises and understands the Inspector’s message that we are all collectively responsible for all that happens in the world. At times she acts as almost an assistant to the Inspector, in that she supports his criticism of the other characters, becoming his mouthpiece when he has left the stage. Sheila’s character becomes quite didactic and this can make her a character with whom the audience do not sympathise with as her change has happened far too quickly and so she is in some ways quite unrealistic. |