tarian

Tarian 通过预先注册受信任的进程和受信任的文件签名，保护运行在 Kubernetes 上的应用程序免受恶意攻击。Tarian 会检测未知进程和对已注册文件的更改，然后发送告警并采取自动化操作。保护您的 K8s 环境免受勒索软件侵害！ 我们希望将此项目作为开源项目维护，以对抗针对我们最喜爱的 Kubernetes 生态系统的攻击。通过持续贡献，我们可以作为社区共同应对威胁。 Tarian 是如何工作的？ Tarian 集群代理运行在 Kubernetes 集群中，检测未知进程和对文件的未知更改，将其报告给 Tarian 服务器，并可选择采取操作：删除违规的 Pod。它使用 eBPF...

cnitch

cnitch cnitch（snitch 或 container snitch）是一个简单的框架和命令行工具，用于监控 Docker 容器以识别任何以 root 身份运行的进程。 为什么这是一件坏事？如果您还没有访问过 can I haz non-privileged containers? by mhausenblas，那么我建议您现在就去那里获取所有信息。 在开发 cnitch 时，我遇到了一个我认为是应用程序错误的问题：cnitch 报告自身在 Docker 容器中是一个 root 进程。我不确定为什么会这样，因为 Dockerfile 明确声明我正在创建一个不以 root...

Cohab_Processes

CohabProcesses Questo script Aggressor è pensato per aiutare i Red Team interni a identificare processi sospetti o estranei "Coabitazione" in esecuzione nei loro ambienti. I Red Team possono assemblare un elenco di processi "noti" in modo indipendente o in collaborazione con la forza Blu e fornir...

EDRHunt

EDRHunt EDRHunt scansiona servizi Windows, driver, processi, registro, WMI per individuare gli EDR installati Endpoint Detection And Response. Leggi di più su EDRHunt qui. Installazione Binario Scarica l'ultima release dalla sezione delle release. Le release sono compilate per windows/amd64. Go...

JShielder - Automates The Process Of Installing All The Necessary Packages To Host A Web Application And Hardening A Linux Server

JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application or services. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server wi...

Malicious Process Detection: Authenticode Not Verified

Binary data wmimalwareauthenticodeinvalidsignedinfo.nbin...

Malicious Process Detection: Authenticode Not Signed

Binary data wmimalwareauthenticodenotsigned.nbin...

Malicious Process Detection: Authenticode With Invalid Signature

Binary data wmimalwareauthenticodeinvalidsigned.nbin...

Malicious Process Detection: User Defined Malware Running (Linux)

Binary data linuxusermd5s.nbin...

Beurk - Experimental Unix Rootkit

BEURK is an userland preload rootkit for GNU/Linux, heavily focused around anti-debugging and anti-detection. NOTE: BEURK is a recursive acronym for B EURK E xperimental U nix R oot K it Features Hide attacker files and directories Realtime log cleanup on utmp/wtmp Anti process and login detectio...

Nessus本地权限提升漏洞

Nessus是一款流行的系统漏洞扫描与分析软件。 Nessus恶意进程检测插件存在安全漏洞，由于该插件会创建一个以SYSTEM运行的服务程序，并且低权限用户可允许修改该程序，允许攻击者利用漏洞创建恶意程序并执行，提升权限。 0 Nessus appliance engine 5.2.1 目前没有详细解决方案提供： http://www.nessus.org/...

NCC00643 Technical Advisory: Nessus Authenticated Scan Local Privilege Escalation

...................................... Vulnerability Summary ...................................... Title Nessus Authenticated Scan - Local Privilege Escalation Release Date 20 March 2014 Reference NGS00643 Discoverer Neil Jones Vendor Tenable Vendor Reference RWZ-21387-181 Systems Affected Nessu...

Malicious Process Detection: Malware Signed By Stolen Bit9 Certificate

Binary data wmibit9running.nbin...

Malicious Process Detection: APT1 Software Running

Binary data wmiapt1running.nbin...

File Locking Local Denial of Service; Impact on sendmail

-----BEGIN PGP SIGNED MESSAGE----- File Locking Local Denial of Service Impact on sendmail Reported by lumpy [email protected] Introduction ============ Any application which uses either flock or fcntl style locking or other APIs that use one of these locking methods such as open with OEXLOCK and...