scirius

======= Scirius Introduction Scirius Community Edition is a web interface dedicated to Suricata ruleset management. It handles the rules file and update associated files. .. image:: https://github.com/StamusNetworks/scirius/raw/master/doc/images/suricata-index.png :alt: Suricata page :align: cent...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

PT-2026-113649

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6 HDRINCL socket to...

Fnord

Fnord Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the fil...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

semgrep-rules

semgrep-rules Welcome! This repository contains Semgrep's Community Edition rules. In addition to the rules in this repository, the Semgrep Registry offers proprietary Pro rules that offer additional language coverage, and unlock crossfile and deep dataflow analysis. Find rules: search for...

CVE-2022-26134-Exploit-Detection

Confluence RCE CVE-2022-26134 Exploit Detection Pre-requisites 1. ClamAV Clone this repository or download the Yara rule on your confluence server We are using the Yara rule provided by volexity/threat-intel who first unveiled this vulnerability. Git Clone git clone...

CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana are vulnerable to an unbounded memory allocation issue. Because the application does not limit the request body size , authenticated users can trigger excessive memory consumption, potentially causing a server crash due to out-of-memory (OOM...

CVE-2021-33766-ProxyToken

CVE-2021-33766 ProxyToken Supports single target detection and batch detection, supports email forwarding rule modification Usage Vulnerability detection and email forwarding rule modification Email forwarding rule modification result Email sending test References...

suricata-vedas

VEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for CVEs This repository is an open, collaborative validation space for CVE detection content: Suricata rules : network detection of exploitation attempts. Nuclei templates : active, non-destructive checks for...

CVE-2022-25636

CVE-2022-25636 netfilter Kernel Privilege Escalation toc Vulnerability Overview Vulnerability ID: CVE-2022-25636 Product: linux kernel - netfilter Affected versions: linux kernel 5.4 Impact: Heap out-of-bounds write in the netfilter kernel module, can lead to privilege escalation when SYSADMIN is...

yaraast

yaraast Parse, analyze, and transform YARA rules with a Python AST toolkit Overview yaraast is a Python library for parsing and manipulating YARA-family rules using Abstract Syntax Trees AST. It supports classic YARA, YARA-L, and YARA-X workflows with automatic dialect detection and CLI tooling...

fwhunt-scan

FwHunt Community Scanner Tools for analyzing UEFI firmware and checking UEFI modules with FwHunt rules. Dependencies rizin v0.6.2 Installation Install with pip tested on python3.6 and above: $ python -m pip install fwhunt-scan Install manually: $ git clone...

detecttrace

DetectTrace A detection should have fired. It didn't. DetectTrace tells you exactly why. DetectTrace is an open-source detection engineering tool for testing security detections end to end and localising the first failing stage. Instead of testing only a SIEM query, DetectTrace treats a detection...

OneRuleToRuleThemStill

OneRuleToRuleThemStill An revamped and optimised version of OneRuleToRuleThemAll. OneRuleToRuleThemStill now has a 5% 6.9% reduction in rules 52,000 down to 49,465 48,414 with 0% performance loss against the Lifeboat and LastFM data breaches. Updates: De-duplication of resulting candidate...

2026-100DaysofYARA

100 Days of YARA 2026 A personal challenge to write one YARA rule every day for 100 days as part of the 100DaysofYARA initiative. More info here: https://github.com/100DaysofYARA/2026...

avpass

AVPASS AVPASS is a tool for leaking the detection model of Android malware detection systems i.e., antivirus software, and bypassing their detection logics by using the leaked information coupled with APK obfuscation techniques. AVPASS is not limited to detection features used by detection system...

2026

100 Days of YARA 2026 Welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! For now, any associated blogging, walkthroughs, or other musing can be hoste...

DonkAI

Hands-on lab for the OWASP Top 10 for LLM Applications 2025 - no real LLM required. DonkAI is deliberately vulnerable web app you can run in one command and use to learn how LLM-integrated systems get broken by actually breaking them. Every OWASP LLM Top 10 category is represented by at least one...

SharpAppLocker

SharpAppLocker C port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions. Useful when you already bypassed AppLocker initially and you don't want to leave PS logs Looking for a pre-compiled versio...