JSAnalyzer

JS Analyzer - Extensión de Burp Suite por Jensec https://x.com/jensec Una potente extensión de Burp Suite para análisis estático de JavaScript. Extrae endpoints de API, URLs, secretos y direcciones de correo electrónico de archivos JavaScript con un filtrado inteligente de ruido. El objetivo es...

GoPurple

GoPurple このプロジェクトは、さまざまなシェルコードインジェクション手法を簡潔にまとめたもので、エンドポイント検出評価のプロセスを効率化することを目的としています。また、自分自身にGolangの世界に飛び込むという挑戦も含まれています。 インストール 1 - go のインストールが必要です。 2 - プロジェクトのディレクトリからアプリケーションをビルドします: go build。ビルドシステムがWindowsでない場合は、GOOS=windows を設定してください。 / | | | | | | | | | | |/ | ' | | | | '| ' | |/ \ | ||...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

EventHorizon

EventHorizon EventHorizon は、セキュリティアナリストや研究者に Event Tracing for Windows ETW テレメトリを提供し、Sigma のようなルールと組み合わせることで堅牢なエンドポイント検出および対応機能を実現するツールです。ただし、EventHorizon は適切なソリューションの代替にはなりません。このプロジェクトの主な目的は、ETW テレメトリの収集とコードを記述せずに検出ルールを生成する際の使いやすさを実現することです。この使いやすさを高めるため、EventHorizon...

attack_monitor

Attack Monitor Attack Monitor 是一个用 Python 编写的应用程序，旨在增强 Windows 7/2008（及所有更新版本）工作站/服务器的安全监控能力，并自动化恶意软件的动态分析。 当前模式（互斥）： 端点检测 ED 恶意软件分析（在专用虚拟机上） 基于以下来源的事件： Windows 事件日志 Sysmon Watchdog（文件系统监控 Python 库） TShark（仅恶意软件分析模式） 当前版本 0.9.0 Alpha 联系方式 [email protected] 演示 支持的操作系统 Windows 7、8、10（x86 或 x64...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

clawdstrike

Clawdstrike 群れの時代のEDR。 Fail closed. Sign the truth. ステータス: pre-1.0 beta. 公開APIは安定していますが、デフォルトは1.0までにさらに厳しくなる可能性があります。...

vortex

🚩 こちらはvortexの公開リポジトリです。最新バージョンとアップデートについては、https://porchetta.industries/ からのサポートをご検討ください。 Vortex VPN総合偵察、テスト、列挙、エクスプロイトツールキット 🚩 スポンサー このプロジェクトをスポンサーしていただき、vortexの最新アップデート、最新の修正、最新機能を入手したい場合は、https://porchetta.industries/ でサポートをお願いします。 公式Discordチャンネル Discordで遊びに来てください！ Porchetta Industries 概要...

APTSimulator

APT模拟器 重要提示：如果您不打算开发一些测试，请不要仅仅通过ZIP下载或克隆仓库。请使用发布版中的包，其中包含打包版本，使用加密归档文件，不包含明文样本和工具。 APT模拟器是一个Windows批处理脚本，它使用一组工具和输出文件使系统看起来像被入侵了一样。与其他对手模拟工具不同，APT模拟器旨在使应用程序尽可能简单。您无需在虚拟机集上运行Web服务器、数据库或任何代理。只需下载准备好的归档文件，解压，然后以管理员身份运行包含的批处理文件。运行APT模拟器只需不到一分钟的时间。 用例 1. 概念验证：端点检测代理/失陷评估工具 2. 测试您的安全监控的检测能力 3...

EDRception

参见：https://malwaretech.com/2023/12/silly-edr-bypasses-and-where-to-find-them.html...

rustinel v1.8.0-rc.1

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

rustinel v1.4.0

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar

Your pentest report looks clean. That might be the problem. Run automated pentesting long enough, and the new findings start to dry up. By the third or fourth run, fewer issues appear. The report looks stable. Leadership reads "stable" as "secure." It usually isn't. The work slows down. The risk...

PT-2026-48154

The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. This leads to an integer wrap-around if the data is larger than the maximum unsigned integer value 32-bit. Attackers could create a collidi...

Closing the Sim-To-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR

Leading commercial endpoint detection and response EDR products have shifted from operator-configured rule sets to multi-component systems where autonomous AI components operate alongside, and increasingly in place of, operator-deployed policies. Autonomous defense agents using commercial EDR as...

How Leading Organizations Are Turning EDR Into Operational Resilience

Most organizations now recognize that endpoint protection alone is no longer sufficient. That's why adoption of endpoint detection and response EDR has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require...

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection

As threats become more coordinated and faster to execute, endpoint protection has become the proving ground for modern defense. For the seventh consecutive time, Microsoft has been named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. We believe this reflects both the...

From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Defender Experts identified an active cryptojacking campaign in which malicious download sites are surfaced not only through traditional search engine poisoning, but also through A...

Converge Connect: Unlock Lower Premiums with Proven Qualys Security

Key Takeaways Qualys, in collaboration with Converge, has launched an offering that ties your security posture to your cyber insurance costs. The Qualys Converge Connect Insurance Report CCIR supplements manual insurance questionnaires with objective, platform-generated, real-time security data...

Your Cloud Detection Strategy in 2026: What to Expect at the Global Cybersecurity Summit

Cloud environments have changed how security teams detect and respond to threats. Signals come from more places, identities are harder to track, and attacks rarely stay within a single system. For many teams, the challenge is no longer visibility. It is having the risk context to understand what...