rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

ARTLAS

ARTLAS Apache 实时日志分析系统 实时 Apache 日志分析器，基于 OWASP 十大漏洞，识别对您 Web 应用程序的探测尝试，并通过 Telegram、Zabbix 和 Syslog/SIEM 通知您或您的应急团队。 ARTLAS 使用来自 PHP-IDS 项目的正则表达式来识别探测尝试，下载最新版本文件的链接： 下载文件 更新日志 - 为 syslog 和 SIEM 添加 CEF 支持 - 添加连接到 syslog 服务器或 SIEM 的选项 - 添加 Zabbix 集成，支持不同触发器 - 代码审查，添加类结构 - 添加虚拟主机功能 - 添加详细输出启用 - 修复...

FalconHound

FalconHound 注意： 自BloodHound CE 7.0版本发布以来，默认数据库已切换为Postgres。此版本的FalconHound仍然依赖Neo4j作为默认数据库。 如果您想在运行最新BloodHound版本的同时继续使用FalconHound，请在您的bloodhound.config.json文件中添加以下行。json "graphdriver": "neo4j", BloodHound 团队将在至少一年内继续支持 Neo4j。在此时间范围内，希望要么有重大的 API 改进，要么我们已为 FalconHound 实现了 PGSQL 支持。 --- FalconHou...

Incident-Response-Powershell

PowerShell 数字取证与事件响应 此仓库提供基于 PowerShell 的事件响应脚本。 DFIR 脚本 DFIR-Script.ps1 脚本收集 Windows 设备上的取证痕迹。主要功能包括： 收集超过 25 个潜在入侵指标。 基于 CSV 的导出文件，用于 SIEM 集成。 与 Microsoft Defender for Endpoint 实时响应集成。 细化响应脚本 这些脚本执行特定任务，例如收集 Windows 安全事件、重置活动用户会话或将文件夹上传到 Azure 存储 Blob。部分脚本使用 API...

malwarescanner

MalwareScanner ハッシュ比較による非常に基本的なマルウェアスキャナー インシデント対応時に必要になることがあります。 対応中に新規または不審なファイルを発見した場合、それらのファイルがシステム内のどこに存在するかを確認したいことがあります。そのような場合にこのツールが必要になるかもしれません。これはデモバージョンであり、完全ではありません。コードを変更・修正して、自分用にカスタマイズする必要があります。 変更が必要な点や追加機能のご要望があればお知らせください。 役に立った場合は「スター」を押してください。改善を続ける励みになります。 特徴...

LDAPMon

LDAPMon LDAPMon 是 Microsoft-Windows-LDAP-Client ETW 提供程序的一个 POC 遥测收集器。启动后，日志将存储在事件查看器中。该 POC 附带一个 Sentinel 解析器，因此如果您想在 SIEM 中收集这些数据，可以这样做。最好在 Sysmon 旁边运行。 安装 以管理员身份打开 cmd 或 PowerShell 提示符。 运行 LDAPMon.exe。 不要关闭 LDAPMon 窗口。 如果一切成功，您将看到以下内容： .\LDAPMonitor.exe Uninstalling Manifest.... Manifest...

Open-Source-Threat-Intel-Feeds

免费威胁情报/IOC 源 本仓库包含可免费使用的开源威胁情报源，无需额外要求即可使用。CSV 文件 ThreatIntelFeeds 以结构化方式存储，基于供应商、描述、类别和 URL 进行组织。提供威胁情报源的供应商将在下文进行描述。 可用的源类别如下： SSL IP DNS URL MD5 SHA1 SHA256 CVEID JA3 NamePipes 内容按原样提供。在商业环境中使用这些内容时，必须先研究使用条件，某些内容在特定条件下可能无法自由使用。是否属于这种情况，由您自行负责研究。 类别| 数量 ---|--- DNS| 17 IP| 78 MD5| 12 SHA1| 5...

Exploit for Improper Handling of Length Parameter Inconsistency in Mongodb

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Sc...

PCI DSS 4.0 FIM Requirements Simplified with Qualys File Integrity Monitoring

File Integrity Monitoring FIM is one of the essential requirements under PCI DSS 4.0. It helps organizations detect and respond to unauthorized changes in critical system files, configuration files, or content files, which is crucial for maintaining the security of cardholder data. Organizations...

Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!

Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the...

The importance of combined user and data behavior analysis in anomaly detection

Muqeet Khan, Head of Sales Engineering Australia and New Zealand For decades security teams have understood the importance of tracking user behavior to identify potential cybersecurity threats. Behavior analysis systems first appeared in the early 2000s, and in 2015 Gartner officially defined Use...

Automating Agent-less Vulnerability Assessment for Intune Enrolled Mobile Devices

Most Mobile Device Management solutions lack critical functionality such as vulnerability assessment and patch management. Integration with a popular MDM like Microsoft Intune allows Qualys to provide automated onboarding and continuous scanning of your mobile devices, among other functions to...

Add Security Events to Your Monitoring Tools

Real-time monitoring is important in every organization because it enables stakeholders to understand what is happening at any given time and react quickly. There are a lot of systems and devices we can and should monitor using tools such as application performance monitoring, digital performance...

Why You Need Cloud-Based Security for Agile, Innovative and Lean IT

Digital transformation isn't just a buzzworthy trend or a finite phase for today's businesses. Rolling adaptation to an ever-changing environment and continuous digital evolution has become the new normal for enterprises -- the key to success in this agile, demanding, and hyper-connected age. To...

Excerpts From: Do More with Less—How Endpoint Security in the Cloud is Helping Companies Stay Secure

If you're responsible for security at your company, you know that you're held back by things like limited budgets, a lack of skilled personnel, and too many security products complicating your stack. In Carbon Black’s recent webinar, we discussed how endpoint security in the cloud can simplify yo...

Partner Perspectives: Extend Visibility Without Expanding Your Team

The best partnerships seem destined from the start - Han Solo and Chewbacca, Mario and Luigi - even newer partners, like Groot and Rocket. The best partners combine their strengths to expand the opportunities available to them. This is true of partnerships in cybersecurity stay with us here. Bett...

Make Application Access IT-Friendly

More and more companies are looking at alternatives to VPNs due to the security risks associated with network level access. And increasingly, the goal is to eliminate network trust through a zero trust architecture - which is one of the primary reasons many of these organizations are deploying...

Maximize security insights by integrating threat intelligence data from Akamai with your SIEM

Since 2005, when Gartner coined the term, SIEM Security Information and Event Management solutions have grown in importance for the security industry. SIEM solutions provide a centralized view to easily access and analyze security information from multiple sources, and then prioritize mitigation...

Superior and safe user experiences with the Akamai Cloud Delivery Platform

Your customers are unique and they all expect fast, secure, personalized digital experiences. They are spread across the world, in regions of varying network connectivity, utilize a plethora of devices and screen sizes - making it challenging to deliver your experiences. By delivering 95 Exabytes...

Dropbox: CSV Injection with the CVS export feature

The report mentions a well known problem with any CSV export function. If the exported data has an Excel formula, the user will be warned and if the user clicks through a warning they might get some code execution. At the same time, fixing this bug means that the CSV data is no longer correct and...