Some OpenCanary scripts to share

[SecuriLee]

I have some scripts running on my OC instances:

process-monitor.sh

• watches the opencanaryd/twistd process, it sometimes borks. Sends webhook if that happens

folder-watcher.sh

• watches your open SMB share, copies files that are dropped there, submits to VirusTotal

oc-monitor.sh

• does a loopback to see if telnet is working (avoids logging) and will try to restart the process and finally reboot if it does not work

https://github.com/orgs/TheOpenCanaryExperience/repositories

[SecuriLee]

I've added an updated vnc.py which will avoid this:
It now contains around 1000 common passwords.

https://github.com/TheOpenCanaryExperience/Scripts-Tips-and-Tricks/blob/main/modules/vnc.py

(I hope this is not a performance killer, I now run with it on 3 OCs facing the Internet)

[SecuriLee]

Visualisation picking up in Splunk for VNC password guesses :)

[jayjb]

Hi @SecuriLee,

I completely missed this. It really looks very cool. Thanks for bringing it up. 1000 passwords sounds reasonable.

Re: the script. They sound very useful! Let me see if we could include them as an operational addition of sorts.