APT-Hunter

APT-Hunter APT-Hunter ist ein Bedrohungsjagd-Tool für Windows-Ereignisprotokolle, das mit einer Purple-Team-Denkweise entwickelt wurde, um APT-Bewegungen zu erkennen, die im Meer von Windows-Ereignisprotokollen verborgen sind, und so die Zeit zur Aufdeckung verdächtiger Aktivitäten zu verkürzen...

EDRaser

EDRaser Bedienungsanleitung EDRaser ist ein leistungsstarkes Werkzeug zum Fernlöschen von Zugriffsprotokollen, Windows-Ereignisprotokollen, Datenbanken und anderen Dateien auf entfernten Rechnern. Es bietet zwei Betriebsmodi: automatisch und manuell. Automatischer Modus Im automatischen Modus...

OSSEM

Open Source Security Events Metadata OSSEM Ein von der Community geleitetes Projekt, das sich hauptsächlich auf die Dokumentation, Standardisierung und Modellierung von Sicherheitsereignisprotokollen konzentriert. https://ossemproject.com/intro.html Ziele Ein gemeinsames Datenmodell definieren un...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI – ein PowerShell-Modul zur Bedrohungsjagd mithilfe von Windows-Ereignisprotokollen Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Beispiel-EVTX-Dateien befinden sich im Verzeichnis .\evtx Hinweis Sollte I...

ThreatHound

ThreatHound ThreatHound è uno strumento avanzato di cybersicurezza progettato per facilitare l'efficiente rilevamento e analisi delle minacce, dei log degli eventi di Windows. Offre un'interfaccia intuitiva per la gestione e l'analisi dei dati di sicurezza. Le caratteristiche principali includono...

epagneul

epagneul Epagneul è uno strumento per visualizzare e investigare i log degli eventi di Windows. Deploy Richiede che docker e docker-compose siano installati. Installazione root@kitploit: make Deploy offline Su una macchina connessa a internet, costruisci una release offline: root@kitploit: make...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

evtx-baseline

evtx-baseline Un repository che ospita esempi di log evtx goodware con installazioni di software campione e interazioni utente di base Donazioni win10-client.tgz di @phantinuss win11-client.tgz di @frack113 win7-x86.tgz di @pH-T win2022-evtx.tgz di @Neo23x0 win2022-ad.tgz di @frack113...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

github-logs

GitHub Logs Estraendo approfondimenti OSINT da 15TB di GitHub Event Logs Abbiamo sviluppato 3 workflow Trickest che hanno elaborato e arricchito l'intero dataset dei GitHub Event Logs, fornendoci alcune preziose informazioni. Ora, l'intera community può beneficiare di questi risultati. Sapevi che...

PT-2026-65862

Name of the Vulnerable Software and Affected Versions BlackBerry QNX affected versions not specified Description Improper input validation in the decode function of the traceparser library allows an attacker to use a corrupted kernel trace event log .kev file to execute arbitrary code or cause a...

PYSEC-2026-2354 Apache Airflow has an Authorization Bypass Through User-Controlled Key

The Event Log detail endpoint GET /api/v2/eventLogs/eventlogid in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-lo...

CVE-2026-12681

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended ...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

Beyond Pass/Fail: Using Process Mining to Understand How LLMs Resist (And Fail) Red Team Attacks

Standard AI red teaming evaluations reduce adversarial campaigns to a single binary outcome, attack success rate ASR, not taking into account the sequential structure of how models resist or yield to attacks. We propose applying process mining, a discipline for discovering and analyzing process...

CVE-2026-46764

The Event Log detail endpoint GET /api/v2/eventLogs/eventlogid in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-lo...

EUVD-2026-33584

The Event Log detail endpoint GET /api/v2/eventLogs/eventlogid in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-lo...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...