169 matches found
MrKaplan
Mr.Kaplan Description MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user. This tool is inspired by MoonWalk, a similar tool for Uni...
Ghost-In-The-Logs
Ghost In The Logs This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here Usage You can grab the lastest release here Starting off Once you've got the latest version execute it with no arguments to see the avalible commands root@kitploit: $ gitl.exe...
Winshark
Winshark Wireshark plugin to work with Event Tracing for Windows Microsoft Message Analyzer is being retired and its download packages were removed from microsoft.com sites on November 25 2019. Wireshark have built a huge library of network protocol dissectors. The best tool for Windows would be...
Suborner
Suborner: The Invisible Account Forger What's this? A simple program to create a Windows account you will only know about : Create invisible local accounts without net user or Windows OS user management applications e.g. netapi32::netuseradd Works on all Windows NT Machines Windows XP to 11,...
sysmon-modular
sysmon-modular | مستودع إعدادات Sysmon ليتمكن الجميع من تخصيصه هذا مستودع إعدادات Microsoft Sysinternals Sysmon حمّله من هنا، صُمم بطريقة نمطية لتسهيل الصيانة وتوليد إعدادات محددة. يرجى الأخذ في الاعتبار أن أيًا من هذه الإعدادات يجب اعتباره نقطة بداية، ويُوصى بشدة بضبطه حسب البيئة. ملاحظة: للحصول...
EventLogging
Notice This repo is no longer maintined as of April 2024 BHIS Notice This repo is no longer maintined as of April 2024 EventLogging This repo contains guidance on setting up event logging. This guidance is broken up into sections, Defensive Readiness Condition DEFCON, and intended to be applied...
Audix
root@kitploit: | / /| | / / / / / |// / // // // / / // |,/ ,/ // //|| is a PowerShell tool to quickly configure the Windows Event Audit Policies for monitoring & incident response. Please note: This tool will only change the local security policy. If applied to a host with a GPO setting, it is...
santa
Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...
CVE-2026-61347
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...
CVE-2026-59137
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...
CVE-2026-59126
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
EUVD-2026-56611
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
CVE-2026-59126 Windows Event Logging Service Elevation of Privilege Vulnerability
...
CVE-2026-59126
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
CVE-2026-59126 Windows Event Logging Service Elevation of Privilege Vulnerability
...
CVE-2026-59126
The CVE refers to a race condition in Windows Event Logging Service where concurrent execution on a shared resource with improper synchronization can enable a local, authorized user to elevate privileges. Affected component: Windows Event Logging Service; root cause: race condition due to insuffi...
CVE-2026-61347
CVE-2026-61347 describes a buffer over-read in Windows Event Logging Service that allows an authorized attacker with LOW privileges and local access to disclose information. The CVSS 3.1 metrics indicate a MEDIUM base score (5.5), with LOCAL attack vector, low attack complexity, no user interacti...
CVE-2026-61347 Windows Event Logging Service Information Disclosure Vulnerability
...