pingback

Detección de C2 Pingback Un paquete de Zeek y reglas de Suricata para la detección de túneles de ping ICMP creados por la herramienta C2 Pingback. Entrada de blog complementaria: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Instalación La forma más sencilla de instalar este...

suricata-vedas

Suricata VEDAS Generación autónoma de reglas de Suricata para CVEs impulsada por VEDAS Propósito Este repositorio sirve como un espacio abierto y colaborativo de validación para las reglas de Suricata generadas de forma autónoma por el Sistema de Agregación de Datos de Vulnerabilidades y Exploits...

galah

简介：Galah（/ɡəˈlɑː/，发音为“guh-laa”）是一个基于LLM的Web蜜罐，旨在模仿各种应用程序并动态响应任意HTTP请求。Galah支持主流LLM提供商，包括OpenAI、GoogleAI、GCP的Vertex AI、Anthropic、Cohere和Ollama。 与传统Web蜜罐手动模拟特定Web应用程序或漏洞不同，Galah能够动态生成与任意HTTP请求相关的响应——包括HTTP标头和正文内容。LLM生成的响应会缓存一段可配置的时间，以避免对相同请求重复生成，从而降低API成本。缓存是端口专用的，确保为特定端口生成的响应不会在另一个端口上对相同请求复用。...

sigint-hombre

sigint-hombre Autor: John Page — malvuln aka hyp3rlinx Copyright c 2026 Propósito: Generar reglas de detección derivadas de Suricata a partir de indicadores de amenazas en vivo de URLhaus en tiempo de ejecución e implementarlas en la plataforma Security Onion para monitoreo de red en tiempo real...

Log4Shell_CVE-2021-44228_related_attacks_IOCs

Log4Shell（CVE-2021-44228）related attacks IOCs 源IP使用Apache Log4j RCE尝试攻击，其中包含很大部分Tor节点，详见Attack-IP.md 利用log4j漏洞传播的恶意程序、Botnet等IOC详见IOC-C2.md Snort检测规则详见Snort.md Suricata规则详见Suricata.md...

threat-intel

threat-intel 이 저장소에는 Volexity 공개 위협 인텔리전스 블로그 게시물과 관련된 IoC가 포함되어 있습니다. 이러한 IoC와 관련된 공개 블로그 게시물은 Volexity 웹사이트에서 확인할 수 있습니다. 과거에는 이 저장소에 Volexity가 발표한 도구도 저장되었습니다. 이러한 도구는 이제 각 도구 전용 저장소로 이동되었으며, Volexity GitHub 페이지에서 찾을 수 있습니다. IOCs 연도별로 정리되어 있으며, 각 연도 내에서 각 폴더는 특정 게시물과 연결됩니다. 각 게시물은 대략 동일한 폴더 구조...

C2-detection-manjusaka

Detecting the "Manjusaka" C2 framework Detecting the C2 framework Manjusaka: "A Chinese sibling of Sliver and Cobalt Strike" References: Detection logic details: https://corelight.com/blog/detecting-manjusaka-c2-framework Writeup by Talos:...

CVE-2025-32433

Erlang/OTP SSH CVE-2025-32433 安全研究 Python 漏洞利用概念验证 CVE-2025-32433 在 Erlang/OTP SSH 中的未认证远程代码执行。我还提供了一个 横幅抓取 Nuclei 模板 和一个 Nuclei RCE 检测。 Suricata 和 Zeek IDS 日志按顺序记录了：一次成功的 Paramiko 攻击，两次未受攻击的正常 OpenSSH9.8 连接，两次使用 ProDefense/CVE-2025-32433 的成功攻击，以及一次使用 iamnoooob、rootxharsh、pdresearch 的...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy Señuelo de prueba de concepto defensivo para CVE-2025-59287 WSUS. El señuelo emula los endpoints web de WSUS en los puertos 8530 y 8531, captura cuerpos de solicitudes HTTP completos y cabeceras, almacena evidencia para análisis forense, e incluye un arnés de pruebas de Windows para...

suricata-rule-CVE-2025-53770

suricata-rule-CVE-2025-53770 Reglas de detección para CVE-2025-53770 root@kitploit: alert http $EXTERNALNET any - $HOMENET any msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, toserver; http.uri;...

suricata-detections

suricata-detections Network IDS signature development grounde...

SigInt-Hombre 1.0

SigInt-Hombre is a python script that generates derived Suricata detection rules from live URLhaus threat indicators at runtime and deploys them to the Security Onion platform for high-coverage real-time network monitoring...

SUSE CVE-2025-59149

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attributetype which is long with transforms can lead to a stack buffer overflow during Suricata startup or duri...

PT-2025-11967 · Suricata +1 · Suricata +1

Name of the Vulnerable Software and Affected Versions: Suricata versions affected versions not specified Description: The issue is related to high memory usage caused by the hashsize setting via rules in Suricata. Recommendations: At the moment, there is no information about a newer version that...

wolf-tools

wolf-tools Open source tools and scripts by Arctic Wolf:...

Exploit for CVE-2021-42292

CVE-2021-42292 This package will detect exploits of CVE-202...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Solarwinds Orion_Platform

This is a collection of Suricata rules and related information for various vulnerabilities. Here's a summary of the content: Rules: 1. Behinder3: Two rules for detecting Behinder3 PHP HTTP Request and Response. The rules set the behinder3 flowbit when the conditions are met. 2. Apache Nifi API RC...

Exploit for CVE-2021-1675

PrintNightmare CVE-2021-1675 This Zeek script detects succe...

suricata-rules

It is an offensive tool for cryptocurrency mining. The repository contains rules for detecting DNS queries to public cryptocurrency mining pool domains. The rules are designed to identify queries to various mining pool domains, including pool.minergate.com, pool.minexmr.com, opmoner.com,...