$ show JohnLaTwC/Shared
This repository is a collection of blog posts, presentations, Jupyter notebooks, and scripts by John Lambert (@JohnLaTwC), a renowned security engineer from Microsoft. It serves as a knowledge base for security defenders, covering topics such as attack graph theory, the MS08-067 vulnerability story, and the 'Githubification of InfoSec' concept, which advocates for open, community-driven security practices using MITRE ATT&CK, Sigma rules, and Jupyter notebooks. The notebooks focus on malware analysis, shellcode reverse engineering, and threat hunting, often leveraging VirusTotal APIs and custom disassembly tools. The Yara rules provide detection for document-based attacks. The PowerShell scripts are utilities to restore Windows Defender to a secure configuration. While the content is highly educational and demonstrates deep security expertise, the repository does not constitute a structured application or a reusable data pipeline; it is a curated set of resources for learning and reference.
The LLM identified 3 files worth highlighting for reuse:
This notebook implements custom IPython cell and line magics (%%blockhash, %ip, %port) that resolve obfuscated Windows API hashes in shellcode disassembly. It loads a precomputed hash database (apihashes.db) from a remote source and replaces push instructions with DLL!API names. The approach is reusable for any shellcode analysis workflow involving hash-based API lookups.
Demonstrates analysis of a malware sample that uses an environmental key (username hash) for AES-CBC decryption. The notebook shows how to decrypt the payload by extracting the hash from the code itself, illustrating a common technique to circumvent environment-based obfuscation. The methodology is reproducible for similar samples.
A set of Yara rules to detect injected templates in Microsoft Word DOCX files, covering different indicators such as HTTP/HTTPS targets, file protocol URLs, and online file share domains. The rules are well-commented, include references, and can be directly used or adapted by other analysts for threat hunting.