santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

MrKaplan

Mr.Kaplan Description MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user. This tool is inspired by MoonWalk, a similar tool for Uni...

Winshark

Winshark Wireshark plugin to work with Event Tracing for Windows Microsoft Message Analyzer is being retired and its download packages were removed from microsoft.com sites on November 25 2019. Wireshark have built a huge library of network protocol dissectors. The best tool for Windows would be...

Ghost-In-The-Logs

Ghost In The Logs This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here Usage You can grab the lastest release here Starting off Once you've got the latest version execute it with no arguments to see the avalible commands $ gitl.exe Loading the ho...

Suborner

Suborner: The Invisible Account Forger What's this? A simple program to create a Windows account you will only know about : Create invisible local accounts without net user or Windows OS user management applications e.g. netapi32::netuseradd Works on all Windows NT Machines Windows XP to 11,...

EventLogging

Notice This repo is no longer maintined as of April 2024 BHIS Notice This repo is no longer maintined as of April 2024 EventLogging This repo contains guidance on setting up event logging. This guidance is broken up into sections, Defensive Readiness Condition DEFCON, and intended to be applied...

Audix

| / /| | / / / / / |// / // // // / / // |,/ ,/ // //|| is a PowerShell tool to quickly configure the Windows Event Audit Policies for monitoring & incident response. Please note: This tool will only change the local security policy. If applied to a host with a GPO setting, it is best to use the...

CVE-2026-95904

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-83723

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-83695

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-83856

An out-of-bounds read vulnerability exists in the Windows Event Logging Service . This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is associated with CWE-125 and has a CVSS 3.1 base score of 7.5 . No specific exploit code or remediation ...

CVE-2026-83695

A vulnerability in the Windows Event Logging Service involves the use of uninitialized resource (CWE-908). This flaw allows an authorized attacker to perform a local information disclosure , potentially revealing sensitive data on the system. The CVSS 3.1 score is 5.5 (Medium). No specific exploi...

CVE-2026-95904

A buffer over-read vulnerability exists in the Windows Event Logging Service . This flaw allows an authorized attacker to perform a local information disclosure. The vulnerability is assigned a Medium severity (CVSS 3.1 score of 5.5) and is characterized by low attack complexity and low privilege...

CVE-2026-83723

A use of uninitialized resource vulnerability in the Windows Event Logging Service allows an authorized attacker to disclose information locally. The vulnerability is associated with CWE-908 and has a CVSS 3.1 base score of 5.5 (Medium) . No specific exploit details or information regarding parti...

Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Windows Event Logging Service Information Disclosure Vulnerability

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-83856: Windows Event Logging Service Remote Code Execution Vulnerability

Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-83723: Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-83695: Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...