Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

halo-record

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your instrumentation captures tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only,...

CocoaDebug

| Introduction Installation Usage Parameters ---|--- Version| Platform| Languages| Screenshot Introduction As similar with Charles in your App. Shake to hide or show the black bubble. Support iPhone device and simulator Share network details via email or copy to clipboard when y...

CVE-2024-44000

EN GenCookieSessionHijack is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies. This allows the attacker to hijack active admin sessions and gain unauthorized access to the WordPress admin dashboard. Features Extract cookies from WordPre...

Zircolite

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite applies Sigma detection rules to: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs JSON Array logs Key Features Format detection :...

ARTLAS

ARTLAS Apache Real Time Logs Analyzer System Real time Apache log analyzer, based on top 10 OWASP vulnerabilities, identifies attempts of exploration in your web application, and notify you or your incident team on Telegram, Zabbix and Syslog/SIEM. ARTLAS uses the regular expression from the...

SUNBURST

SUNBURST Detection for SUNBURST C2 Stage-1 using Shannon Entropy About: Using Shannon Entropy to detect Domain-Generation Algorithms DGA. It should only be fed FQDNs into the function or read from a CSV file. SYNTAX: Prefixorsubdomain.Domain.TLD Made due to APTs leveraging long-string DGA for Kil...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Introduction This is fork and a significant update from the initial publication on the ISC Storm Center website by Scott Jensen as a BACS paper and the scripts published in Github. https://github.com/fkadriver/Dshield-ELK...

CVE-2022-1077

CVE-2022-1077 Description A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated remotely an...

EDRaser

EDRaser Usage Guide EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual. Automated Mode In automated mode, EDRaser scans the C class of a given address space of IPs...

citrix-logchecker

citrix-logchecker Parse citrix netscaler logs to check for signs of CVE-2023-4966 exploitation Written by Otmar Lendl. Usage: ./citrix-anomaly.pl -d -v -h -p file -a X logfiles This script parse citrix netscale syslog files and looks for session reconnects that might be the result of a...

threat-hunting-guide

Corelight Threat Hunting Guide working copy This repository serves as the working data for the Corelight Threat Hunting Guide. The source prose which is maintained here is periodically put through editing, layout, and graphic design, and then published as a PDF file and distributed by Corelight,...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

CVE-2023-34051

CVE-2023-34051 CVE-2023-34051 is an authentication bypass that bypasses the patch for VMSA-2023-0001. VMSA-2023-0001 for vRealize Log Insight includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control...

CVE-2021-21234

CVE-2021-21234 Directory traversal vulnerability in the spring-boot-actuator-logview library https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234...

CVE-2025-27591-Below

CVE-2025-27591-Below 📌 Description This is a proof-of-concept PoC exploit for CVE-2025-27591 , a local privilege escalation vulnerability in the below system monitor tool. The issue arises from unsafe handling of log files /var/log/below/errorroot.log when executed with elevated privileges. By...

CVE-2022-29806

CVE-2022-29806 ZoneMinder up to 1.36.12 Language privilege escalation and RCE Description A Path Traversal vulnerability in debug log file and default language option in ZoneMinder version before 1.36.13 and 1.37.11 allows attackers to write and execute arbitrary code to achieve remote command...

ossec-hids

OSSEC v4.3.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

cloud-audit

Project Introduction cloud-audit Cloud Security Audit Assistant is a tool for detecting the exploitation of leaked AK/SK from public cloud vendors. It periodically calls cloud platform APIs to audit logs and identifies suspected intrusions based on abnormal behavior, black features, and baselines...