rustinel

Rustinel Windows, Linux, macOS용 오픈소스 엔드포인트 탐지. 네이티브 텔레메트리를 Sigma, YARA, IOC 탐지 및 SIEM 연동 알림으로 변환. Rust로 작성됨. 웹사이트 | 문서 | 다운로드 | SIEM 데모 빠른 시작 Rustinel 릴리스 아카이브에는 바이너리, 기본 설정, 데모 규칙 및 logs/ 디렉터리가 포함되어 있습니다. Windows - PowerShell에서 테스트: root@kitploit: irm https://rustinel.io/install.ps1 | iex 그런 다음...

FalconHound

FalconHound 참고: BloodHound CE 7.0 릴리스부터 기본 데이터베이스가 Postgres로 전환되었습니다. 이 버전의 FalconHound는 여전히 Neo4j를 기본 데이터베이스로 사용합니다. 최신 BloodHound 버전과 함께 FalconHound를 계속 사용하려면 bloodhound.config.json 파일에 다음 줄을 추가하세요.json "graphdriver": "neo4j", root@kitploit: BloodHound 팀은 최소 1년 동안 Neo4j를 계속 지원할 예정입니다. 이 기간 내에 대...

Incident-Response-Powershell

PowerShell 数字取证与事件响应 此仓库提供基于 PowerShell 的事件响应脚本。 DFIR 脚本 DFIR-Script.ps1 脚本收集 Windows 设备上的取证痕迹。主要功能包括： 收集超过 25 个潜在入侵指标。 基于 CSV 的导出文件，用于 SIEM 集成。 与 Microsoft Defender for Endpoint 实时响应集成。 细化响应脚本 这些脚本执行特定任务，例如收集 Windows 安全事件、重置活动用户会话或将文件夹上传到 Azure 存储 Blob。部分脚本使用 API...

LDAPMon

LDAPMon LDAPMon は、Microsoft-Windows-LDAP-Client ETW プロバイダー向けの POC テレメトリコレクターです。起動すると、ログはイベントビューアーに保存されます。この POC には Sentinel パーサーが付属しているため、SIEM 内でこのデータを収集したい場合に利用できます。Sysmon の隣で実行するのが最適です。 インストール 管理者として cmd または powershell プロンプトを開いてください。 LDAPMon.exe を実行してください。 LDAPMon ウィンドウを閉じないでください。...

ARTLAS

ARTLAS 아파치 실시간 로그 분석기 시스템 실시간 아파치 로그 분석기로, OWASP 상위 10대 취약점을 기반으로 웹 애플리케이션에서 탐색 시도를 식별하고, Telegram, Zabbix 및 Syslog/SIEM을 통해 사용자나 사고 대응팀에 알림을 보냅니다. ARTLAS는 PHP-IDS 프로젝트의 정규 표현식을 사용하여 탐색 시도를 식별합니다. 최신 버전 파일 다운로드 링크: 파일 다운로드 변경 로그 root@kitploit: - syslog 및 SIEM에 CEF 추가 - syslog 서버 또는 SIEM에 연결하는 옵션 ...

malwarescanner

MalwareScanner 해시 비교를 통한 매우 기본적인 악성코드 스캐너 침해 대응 시 이와 같은 도구가 필요할 수 있습니다. 대응 중 새롭거나 의심스러운 파일을 발견했다면, 시스템 내 어디에 이러한 파일이 있는지 확인하고 싶을 것입니다. 따라서 이와 같은 도구가 필요할 수 있습니다. 이는 데모 버전이며 완전하지 않습니다. 코드를 변경하고 수정하여 자신의 것으로 만드세요. 필요한 변경 사항이나 추가 기능이 있으면 알려주세요. 도움이 된다면 "별표★"를 눌러주세요. 그러면 계속해서 개선할 수 있습니다. 특징 해시 기반 파일 검...

Open-Source-Threat-Intel-Feeds

無料脅威インテル/IOCフィード このリポジトリには、追加の要件なしで使用できるオープンソースの無料脅威インテルフィードが含まれています。CSVファイル ThreatIntelFeeds は、ベンダー、説明、カテゴリ、URLに基づいて構造化された方法で保存されています。脅威インテルフィードを提供するベンダーについては、以下で説明します。 以下のフィードカテゴリが利用可能です： SSL IP DNS URL MD5 SHA1 SHA256 CVEID JA3 NamePipes...

Exploit for Improper Handling of Length Parameter Inconsistency in Mongodb

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Sc...

PCI DSS 4.0 FIM Requirements Simplified with Qualys File Integrity Monitoring

File Integrity Monitoring FIM is one of the essential requirements under PCI DSS 4.0. It helps organizations detect and respond to unauthorized changes in critical system files, configuration files, or content files, which is crucial for maintaining the security of cardholder data. Organizations...

Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!

Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the...

The importance of combined user and data behavior analysis in anomaly detection

Muqeet Khan, Head of Sales Engineering Australia and New Zealand For decades security teams have understood the importance of tracking user behavior to identify potential cybersecurity threats. Behavior analysis systems first appeared in the early 2000s, and in 2015 Gartner officially defined Use...

Automating Agent-less Vulnerability Assessment for Intune Enrolled Mobile Devices

Most Mobile Device Management solutions lack critical functionality such as vulnerability assessment and patch management. Integration with a popular MDM like Microsoft Intune allows Qualys to provide automated onboarding and continuous scanning of your mobile devices, among other functions to...

Add Security Events to Your Monitoring Tools

Real-time monitoring is important in every organization because it enables stakeholders to understand what is happening at any given time and react quickly. There are a lot of systems and devices we can and should monitor using tools such as application performance monitoring, digital performance...

Why You Need Cloud-Based Security for Agile, Innovative and Lean IT

Digital transformation isn't just a buzzworthy trend or a finite phase for today's businesses. Rolling adaptation to an ever-changing environment and continuous digital evolution has become the new normal for enterprises -- the key to success in this agile, demanding, and hyper-connected age. To...

Excerpts From: Do More with Less—How Endpoint Security in the Cloud is Helping Companies Stay Secure

If you're responsible for security at your company, you know that you're held back by things like limited budgets, a lack of skilled personnel, and too many security products complicating your stack. In Carbon Black’s recent webinar, we discussed how endpoint security in the cloud can simplify yo...

Partner Perspectives: Extend Visibility Without Expanding Your Team

The best partnerships seem destined from the start - Han Solo and Chewbacca, Mario and Luigi - even newer partners, like Groot and Rocket. The best partners combine their strengths to expand the opportunities available to them. This is true of partnerships in cybersecurity stay with us here. Bett...

Make Application Access IT-Friendly

More and more companies are looking at alternatives to VPNs due to the security risks associated with network level access. And increasingly, the goal is to eliminate network trust through a zero trust architecture - which is one of the primary reasons many of these organizations are deploying...

Maximize security insights by integrating threat intelligence data from Akamai with your SIEM

Since 2005, when Gartner coined the term, SIEM Security Information and Event Management solutions have grown in importance for the security industry. SIEM solutions provide a centralized view to easily access and analyze security information from multiple sources, and then prioritize mitigation...

Superior and safe user experiences with the Akamai Cloud Delivery Platform

Your customers are unique and they all expect fast, secure, personalized digital experiences. They are spread across the world, in regions of varying network connectivity, utilize a plethora of devices and screen sizes - making it challenging to deliver your experiences. By delivering 95 Exabytes...

Dropbox: CSV Injection with the CVS export feature

The report mentions a well known problem with any CSV export function. If the exported data has an Excel formula, the user will be warned and if the user clicks through a warning they might get some code execution. At the same time, fixing this bug means that the CSV data is no longer correct and...