DeepBlueCLI

DeepBlueCLI DeepBlueCLI - وحدة باورشيل لصيد التهديدات عبر سجلات أحداث ويندوز إريك كونراد، شركة باكشور للاتصالات، LLC deepblue at backshore dot net تويتر: @ericconrad http://ericconrad.com ملفات EVTX النموذجية موجودة في المجلد .\evtx ملاحظة إذا أثار مضاد الفيروسات لديك قلقًا بعد تنزيل DeepBlueCLI:...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

epagneul

epagneul Epagneul هي أداة لتصور والتحقيق في سجلات أحداث ويندوز. النشر يتطلب تثبيت docker و docker-compose. التثبيت root@kitploit: make النشر دون اتصال على جهاز متصل بالإنترنت، قم ببناء إصدار دون اتصال: root@kitploit: make release سيؤدي هذا إلى إنشاء مجلد release يحتوي على صور docker جاهزة...

winevt_logs_analysis

Winevt logs analysis Remote connections Simple script for the purpose of finding remote connections to Windows machine and ideally some public IPs. It checks for some EventIDs regarding remote logins and sessions. You should pip install -r requirements.txt so the script can work and parse some of...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error in the ConsumeUnit16Array and ConsumeUnit64Array functions. An attacker can cause a process crash by supplying a specially crafted .evtx file to the parseevtx VQL plugin on Windows and Linux systems. Remediation A fix w...

Velocidex Velociraptor has an off-by-one error

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

CVE-2024-34060

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The iris-evtx-module is a pipeline plugin of iris-web that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely...

CVE-2024-34060

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The iris-evtx-module is a pipeline plugin of iris-web that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely...

Grafiki - Threat Hunting Tool About Sysmon And Graphs

Grafiki is a Django project about Sysmon and graphs, for the time being. In my opinion EventViewer, Elastic and even Kibana, are not graphic enough. The current threats are complicated and if attackers think in graphs, defenders also must do it. This is a proof of concept, the code was not debugg...