// odd days
const SingleDay = 'myod1.herokuapp.com'
// plural days
const DoubleDay = 'myod2.herokuapp.com'
// Using CF to do porxy? true/false
const CFproxy = true

// Heroku only has 550 hours/month for free plan by default. 
// This CloudFlare Workers code can let use different Heroku app based on odd or even number's day. 
// Please change above code for your Heroku's app in either SingleDay or Doubleday parameter. 

addEventListener('fetch', event => {
    let nd = new Date();
    if (nd.getDate()%2) {
        host = SingleDay
    } else {
        host = DoubleDay
    }
    if (!CFproxy) {
        let url=new URL(event.request.url);
        if (url.protocol == 'http:') {
            url.protocol = 'https:'
            response = Response.redirect(url.href);
            event.respondWith( response );
        } else {
            url.hostname=host;
            let request=new Request(url,event.request);
            event.respondWith( fetch(request) )
        }
    } else {
        event.respondWith( fetchAndApply(event.request) );
    }
})

async function fetchAndApply(request) {
    let response = null;
    let url = new URL(request.url);
    if (url.protocol == 'http:') {
        url.protocol = 'https:'
        response = Response.redirect(url.href);
        return response;
    }
    url.host = host;

    let method = request.method;
    let body = request.body;
    let request_headers = request.headers;
    let new_request_headers = new Headers(request_headers);

    new_request_headers.set('Host', url.host);
    new_request_headers.set('Referer', request.url);

    let original_response = await fetch(url.href, {
        method: method,
        body: body,
        headers: new_request_headers
    });

    response = new Response(original_response.body, {
        status: original_response.status,
        headers: original_response.headers
    })

    return response;
}

Kansa

• GitHub - Davehull/Kansa
• https://ift.tt/3sz6wPq
• https://ift.tt/1wEwKfB
• Kansa: A PowerShell-based incident response framework

PS C:\ISOScripting\Kansa-master\Kansa-master> .\kansa.ps1 -target testmachine1
VERBOSE: Found Modules\\Modules.conf.
VERBOSE: Running modules:
Get-PrefetchListing
Get-WMIRecentApps
Get-Netstat
Get-DNSCache
Get-ProcsWMI
Get-LogUserAssist
Get-SvcFail
Get-SvcTrigs
Get-WMIEvtFilter
Get-WMIFltConBind
Get-WMIEvtConsumer
Get-PSProfiles
Get-SchedTasks
Get-File
Get-LocalAdmins
VERBOSE: Waiting for Get-PrefetchListing to complete.

Id     Name            PSJobTypeName   State         HasMoreData     Location             Command
--     ----            -------------   -----         -----------     --------             -------
1      Job1            RemoteJob       Completed     True            testmachine1            <#...
VERBOSE: Waiting for Get-WMIRecentApps to complete.
3      Job3            RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-Netstat to complete.
5      Job5            RemoteJob       Completed     True            testmachine1            <#...
VERBOSE: Waiting for Get-DNSCache to complete.
7      Job7            RemoteJob       Completed     True            testmachine1            <#...
VERBOSE: Waiting for Get-ProcsWMI to complete.
9      Job9            RemoteJob       Completed     True            testmachine1            <#...
VERBOSE: Waiting for Get-LogUserAssist to complete.
11     Job11           RemoteJob       Failed        True            testmachine1            <#...
VERBOSE: Waiting for Get-SvcFail to complete.
13     Job13           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-SvcTrigs to complete.
15     Job15           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-WMIEvtFilter to complete.
17     Job17           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-WMIFltConBind to complete.
19     Job19           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-WMIEvtConsumer to complete.
21     Job21           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-PSProfiles to complete.
23     Job23           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-SchedTasks to complete.
25     Job25           RemoteJob       Failed        False           testmachine1            <#...
VERBOSE: Waiting for Get-File C:\Windows\WindowsUpdate.log to complete.
27     Job27           RemoteJob       Failed        False           testmachine1            <# ...
VERBOSE: Waiting for Get-LocalAdmins to complete.
29     Job29           RemoteJob       Failed        False           testmachine1            <#...
Script completed with warnings or errors. See C:\ISOScripting\Kansa-master\Kansa-master\Output_20181029102057\Error.Log
for details.


PS C:\ISOScripting\Kansa-master\Kansa-master> ls


    Directory: C:\ISOScripting\Kansa-master\Kansa-master


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       29/10/2018   8:54 AM                Analysis
d-----       29/10/2018   8:54 AM                Modules
d-----       29/10/2018  10:18 AM                Output_20181029101813
d-----       29/10/2018  10:18 AM                Output_20181029101855
d-----       29/10/2018  10:19 AM                Output_20181029101903
d-----       29/10/2018  10:20 AM                Output_20181029102044
d-----       29/10/2018  10:27 AM                Output_20181029102057
-a----       29/10/2018   8:54 AM             89 .gitignore
-a----       29/10/2018   8:54 AM           3217 CODE_OF_CONDUCT.md
-a----       29/10/2018   8:54 AM           3540 contributing.md
-a----       29/10/2018   8:54 AM          50110 kansa.ps1
-a----       29/10/2018   8:54 AM          11323 LICENSE
-a----       29/10/2018   8:54 AM           3212 MSLimitedPublicLicense.txt
-a----       29/10/2018   8:54 AM           3770 README.md


PS C:\ISOScripting\Kansa-master\Kansa-master>

Awesome Incident Response

Tools can scan remote network drives

• SuperAntiSpyware - it can scan remote share network drives, which MalwareBytes can't do since 2015 , although it used to be
• EMCO Network Malware Cleaner -
• Emsisoft - Emsisoft Anit-Malware