224 matches found
speakeasy
Speakeasy Speakeasy es un framework de emulación de malware para Windows que ejecuta binarios, controladores y shellcode en un runtime de Windows modelado en lugar de una máquina virtual completa. Emula APIs, el comportamiento de procesos/hilos, el sistema de archivos, el registro y la actividad ...
Vulnerability-Disclosures
Mandiant Vulnerability Disclosures This repository details vulnerabilities disclosed by Mandiant. These vulnerabilities were discovered by internal research, through Red Team assessments, or in use in the wild. Proof of concepts PoCs may or may not be provided. The following licenses/licensing...
capa
Sitio web | Descargar | Interfaz web capa detecta capacidades en archivos ejecutables. Lo ejecutas contra un PE, ELF, módulo .NET, shellcode o un sandbox report y te dice lo que cree que el programa puede hacer. Por ejemplo, puede sugerir que el archivo es un backdoor, es capaz de instalar...
flare-fakenet-ng
root@kitploit: | /\ | |/ / | \ | | | | | \ | |/ | | | / \ | ' /| | | | | | | || | | | | / /\ \ | | | | . | | | || . | | | | | | / | . | || |\ | | | | | |\ | || | ||// \|\|| || || || || D O C U M E N T A T I O N FakeNet-NG 3.5 is a next generation dynamic network analysis tool for malware...
commando-vm
¿Qué es CommandoVM? Complete Mandiant Offensive VM "CommandoVM" es una distribución de seguridad integral y personalizable basada en Windows para pruebas de penetración y red teaming. CommandoVM incluye una variedad de herramientas ofensivas no incluidas en Kali Linux que destacan la eficacia de...
nightHawkResponse
nightHawk Response Aplicación personalizada para la presentación asíncrona de datos forenses sobre un backend Elasticsearch. Esta aplicación está diseñada para ingerir un archivo de "collections" de Mandiant Redline y ofrecer flexibilidad en búsqueda/apilado y etiquetado. La aplicación nació de l...
ioc-scanner-CVE-2019-19781
Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...
stringsifter
StringSifter is a machine learning tool that automatically ranks strings based on their relevance for malware analysis. Quick Links Technical Blogpost - Learning to Rank Strings Output for Speedier Malware Analysis Announcement Blogpost - Open Sourcing StringSifter DerbyCon Talk - StringSifter:...
Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment
CVE-2025-31324 Zero-Day SAP Vulnerability & Compromise Assessment Tool Joint Release by Onapsis & Mandiant Onapsis and Mandiant have collaborated to release an open-source tool to assist SAP customers in identifying potential compromise related to CVE-2025-31324 and CVE-2025-42999 , a critical...
Ghidrathon
Ghidrathon Ghidrathon is a Ghidra extension that adds Python 3 scripting capabilities to Ghidra. Why? Ghidra natively supports scripting in Java and Jython. Unfortunately, many open-source analysis tools, like capa, Unicorn Engine, angr, etc., are written in Python 3 making it difficult, and in...
Mandiant-Azure-AD-Investigator
Mandiant Azure AD Investigator Centrado en las TTP de UNC2452 Resumen Este repositorio contiene un módulo de PowerShell para detectar artefactos que pueden ser indicadores de actividad de UNC2452 y otros actores de amenazas. Algunos indicadores son indicadores de compromiso de "alta fidelidad",...
heyserial
HEY SERIAL! Author: Alyssa Rahman @ramen0x3f Created: 2021-10-27 Last Updated: 2021-12-02 Blog: https://www.mandiant.com/resources/hunting-deserialization-exploits For more details on this tool and the research process behind it, check out our blog! Description Programmatically create hunting rul...
ThreatPursuit-VM
root@kitploit: / || | / | \ | | \ / \ \ \ | | | Y | | \ / / | | || || || \ || |/ | \ | | \ / | | | \ \ | | | | /| | \ | | | || | | /|/ || / |/|||| || / MANDIANT THREAT INTELLIGENCE VM Versión 2020.1 [email protected] root@kitploit: Creado por: Dan Kennedy Jake Barteaux @day1player...
dncil
dncil is a Common Intermediate Language CIL disassembly library written in Python that supports parsing the header, instructions, and exception handlers of .NET managed methods. Parsed data is exposed through an object-oriented API to help you quickly develop CIL analysis tools using dncil. Why...
citrix-ioc-scanner-cve-2023-3519
Indicator of Compromise Scanner for CVE-2023-3519 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2023-3519. The utility, and its resources, encode indicators of compromise collected during Mandiant investigations. To learn more, please read th...
ioc-scanner-CVE-2019-19781
Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...
Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials
Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to "certain" internal Vercel systems. The incident stemmed from the compromise of Context.ai, a third-party artificial intelligence AI tool, that was used by an employee at the...
Mandiant Global Median Dwell Time Deteriorates from 11 to 14 Days
Oh snap. My single most important cybersecurity metric deteriorated again. In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14...
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
SonicWall has formally implicated state-sponsored threat actors as behind the September security breach that led to the unauthorized exposure of firewall configuration backup files. "The malicious activity – carried out by a state-sponsored threat actor – was isolated to the unauthorized access o...
