Elkeid

Elkeid - Bytedance Cloud Workload Protection Platform English | 简体中文 Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices. With the business...

zeek-long-connections

Long Connections Zeek normally logs connections at the end of the connection, but this can cause trouble for incident responders in the case of very long lived connections that end up being unknown to defenders until too late. This package provides a new log named connlong which will log...

AI-driven-MITRE-Attack

POC : AI-driven MITRE Attack Detection and Alert Enrichment This repository demonstrates a machine learning pipeline for detecting MITRE ATT&CK techniques from logs and enriching the output using a local LLM. Overview The project is divided into two main components : 1. Machine Learning Model ML ...

Sentinel-Queries

KQL for Microsoft Sentinel Some tips, tricks and examples for using KQL for Microsoft Sentinel. 1. Introduction 2. The Anatomy of a KQL Query 3. The Basics 1. Time Basics 2. Where Basics 3. Project Basics 4. Summarize Basics 5. Render Basics 6. Parse and Split Basics Introduction Kusto Query...

CVE-2024-2053

LFI to RCE Exploit via Log Poisoning Python3 exploit for CVE-2024-2053 Artica Proxy 📝 Description This Python3 script exploits Local File Inclusion LFI vulnerabilities to achieve Remote Code Execution RCE through log poisoning techniques. Specifically designed for Artica Proxy CVE-2024-2053 but...

awesome-soc-analyst

awesome-soc-analyst We just collected useful resources for SOC analysts and SOC analyst candidates. This repository is maintained by LetsDefend. Feel free to add new resources here. Table of Contents Books Malware Analysis Practice Labs Phishing Analysis Tools for Investigation Network Log Source...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

goaccess

GoAccess What is it? GoAccess is an open source, real-time web log analyzer and interactive viewer that runs in a terminal on nix systems or directly in your browser. Designed with system administrators, DevOps engineers, and security professionals in mind, it delivers fast, actionable HTTP...

SharpAppLocker

SharpAppLocker C port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions. Useful when you already bypassed AppLocker initially and you don't want to leave PS logs Looking for a pre-compiled versio...

Log4j-RCE

Log4j-RCE Log4j RCE - CVE-2021-44228 How To Run? php log4j.php https://1337.com Requirements PHP CURL PAYLOAD DNS LOG Collaborator Burpsuite or use dnslog.cn List Payload $ctx:loginId $map:type $filename $date:MM-dd-yyyy $docker:containerId $docker:containerName $docker:imageName $env:USER...

CVE-2025-67223

CVE-2025-67223: Incorrect Access Control & Information Disclosure in Aranda Service Desk CVE ID: CVE-2025-67223 Affected Product: Aranda Service Desk Aranda File Server - AFS module Affected Versions: 8.3.12 Author: Brandon Perez Lara 🚨 Overview A critical vulnerability was identified in the file...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py This script first identifies the version to determine if it is a vulnerable version, then attempts to confirm whether the log file exists. If it exists, it will try to send a request and then request the log file again to search for...

CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin est une vulnérabilité Time-of-check time-of-use dans le protocole MS-EVEN. Cette vulnérabilité permet aux utilisateurs à faibles privilèges d'écrire des fichiers arbitraires sur une machine distante, contournant ainsi la nécessité d'un compte Administrateur...

spring-boot-log4j-cve-2021-44228-docker-lab

Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...

ossec-hids

OSSEC v4.3.0 Informations sur OSSEC OSSEC est une plateforme complète pour surveiller et contrôler vos systèmes. Elle regroupe tous les aspects du HIDS détection d'intrusion basée sur l'hôte, de la surveillance des journaux et du SIM/SIEM dans une solution simple, puissante et open source. Visite...

watchguard-sso-client

Proof of Concept for Watchguard SSO Agent Vulnerabilitites CVE-2024-6592, CVE-2024-6593, CVE-2024-6594 Details are described in our advisories available at: CVE-2024-6592 CVE-2024-6593 CVE-2024-6594 The script requires the Python click library to run. Examples Issue Arbitrary Commands to SSO...

SuiteCRM-RCE

CVE-2020-28328 SuiteCRM Remote Code Execution via Log File System Setting and Log File Poisioning Overview I recently discovered two vulnerabilities in SuiteCRM that provides an attack chain for a low privileged user to achieve code execution on the underlying operating system. The attack chain i...

CVE-2022-22965

CVE-2022-22965 2022.04.02 16:44 Optimized POC, no longer a one-time validation Warning: This program will destroy log information integrity, please back up server data! Use only if you have server penetration test authorization! pocsuite -r CVE-2022-22965POCEXP.py -u url As shown below, the progr...