threat-intel

threat-intel Questa repository contiene elementi supplementari, inclusi IOC e firme, discussi nei post del blog di Huntress e in altri media. Organizzazione Questa repository è organizzata per anno; all'interno di quella cartella sarà presente una sottocartella denominata in base al mese e al...

ioccheck

ioccheck Uno strumento per semplificare il processo di ricerca di hash di file, indirizzi IP e altri indicatori di compromissione IOC. Caratteristiche Cerca hash attraverso molteplici servizi di threat intelligence, da un singolo comando o da poche righe di Python. Attualmente supporta i seguenti...

C2-Tracker

C2 Tracker C2 Tracker ist ein kostenlos nutzbarer, gemeinschaftsbetriebener IOC-Feed, der Shodan undCensys Suchanfragen verwendet, um IP-Adressen von bekannter Malware-/Botnetz-/C2-Infrastruktur zu sammeln. Dieses Projekt wurde archiviert Dieses Projekt wurde archiviert. Die Textdateien in data/...

HAFNIUM-IOC

HAFNIUM-IOC Hafnium-IOC è un semplice script PowerShell che viene eseguito sui server Exchange per identificare indicatori di compromissione IOC dall'attività di Hafnium rilasciata da Mircosoft il 02-03-2021 https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/. L...

log4j-ioc-detector

Rilevatore IoC log4j per Linux Un semplice script Bash per rilevare gli Indicatori di Compromissione IoC di log4j in Linux. Come Usare 1. Clona questo repository: root@kitploit: git clone https://github.com/santosomar/log4j-ioc-detector 2. Esegui lo script log4jiocdetector.sh, come mostrato di...

briefr

BRIEFR Intelligence CVE e detection engineering self-hosted Cos'è BRIEFR? · Schermate · Per iniziare · Documentazione · Licenza Cos'è BRIEFR? BRIEFR è una piattaforma self-hosted di intelligence sulle CVE. Recupera i dati sulle vulnerabilità da fonti pubbliche e community — NVD, CISA KEV, EPSS,...

wannacry-soc-lab

WannaCry SOC Investigation Lab Overview This project simu...

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522 Iris has an Improper Authorization issue

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522 Iris has an Improper Authorization issue

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522

Affected software: Iris DFIR-IRIS web collaboration platform. Vulnerable version: earlier than 2.4.28. Issue: optional GraphQL endpoint at /graphql did not enforce the same authorization as the REST API, enabling three unauthorized actions by any authenticated user: (1) IOC read across cases (IDO...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: jfs: Fixed null-ptr-deref in jfsioctrim Syzkaller Report Oops: General Protection Fault, likely for non-canonical addresses 0xdffffc0000000087: 0000 1 KASAN: null-ptr-deref in range 0x0000000000000438-0x000000000000043f CPU: 2...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Memory leaks have been fixed in mpi3mrinitioc. Do not allocate memory again when the IOC is being reinitialized...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011261)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011261 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using iocinfo During...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005427)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005427 advisory. In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfsioctrim Syzkaller Report Oops: general protection fault, probably f...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005807)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005807 advisory. In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfsioctrim Syzkaller Report Oops: general protection fault, probably f...

Increase in Malware Enabled ATM Jackpotting Incidents across United States

The Federal Bureau of Investigation FBI is releasing this FLASH to disseminate indicators of compromise IOCs and technical details associated with malware enabled ATM jackpotting. Threat actors exploit physical and software vulnerabilities in ATMs and deploy malware to dispense cash without a...

OESA-2026-1078 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using iocinfo During mpt3sastransportportremove, messages were logged with devprintk against...

OESA-2026-1073 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using iocinfo During mpt3sastransportportremove, messages were logged with devprintk against...