epagneul

epagneul Epagneul 是一款用于可视化和调查 Windows 事件日志的工具。 部署 需要安装 docker 和 docker-compose。 安装 root@kitploit: make 离线部署 在一台联网的机器上，构建一个离线发行版： root@kitploit: make release 这将创建一个包含随时可用的 docker 镜像的 release 文件夹。 将项目复制到你的隔离机器上，然后运行： root@kitploit: make load make 这将安装： epagneul Web 界面（端口 8080） epagneul 后端（端口 8000）...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - 用于通过Windows事件日志进行威胁狩猎的PowerShell模块 Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com 示例EVTX文件位于.\evtx目录中 注意...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

winevt_logs_analysis

Winevt logs analysis Remote connections Simple script for the purpose of finding remote connections to Windows machine and ideally some public IPs. It checks for some EventIDs regarding remote logins and sessions. You should pip install -r requirements.txt so the script can work and parse some of...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error in the ConsumeUnit16Array and ConsumeUnit64Array functions. An attacker can cause a process crash by supplying a specially crafted .evtx file to the parseevtx VQL plugin on Windows and Linux systems. Remediation A fix w...

Velocidex Velociraptor has an off-by-one error

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

CVE-2024-34060

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The iris-evtx-module is a pipeline plugin of iris-web that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely...

CVE-2024-34060

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The iris-evtx-module is a pipeline plugin of iris-web that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely...

Grafiki - Threat Hunting Tool About Sysmon And Graphs

Grafiki is a Django project about Sysmon and graphs, for the time being. In my opinion EventViewer, Elastic and even Kibana, are not graphic enough. The current threats are complicated and if attackers think in graphs, defenders also must do it. This is a proof of concept, the code was not debugg...