Log4Shell_CVE-2021-44228_related_attacks_IOCs

Log4Shell（CVE-2021-44228）related attacks IOCs Gli IP di origine utilizzano tentativi di attacco Apache Log4j RCE, che includono una grande parte di nodi Tor, vedi Attack-IP.md Per gli IOC di programmi dannosi, Botnet, ecc. che si diffondono utilizzando la vulnerabilità log4j, vedi IOC-C2.md Per l...

CVE-2025-32433

Ricerca sulla sicurezza di Erlang/OTP SSH CVE-2025-32433 Exploit proof-of-concept Python CVE-2025-32433 Esecuzione di codice remoto non autenticata in Erlang/OTP SSH. Ho anche un template Nuclei per banner grabbing e un controllo Nuclei RCE. I log IDS di Suricata e Zeek sono in ordine basati su u...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronunciato ‘guh-laa’ è un honeypot web basato su LLM progettato per emulare varie applicazioni e rispondere dinamicamente a richieste HTTP arbitrarie. Galah supporta i principali provider LLM, tra cui OpenAI, GoogleAI, la Vertex AI di GCP, Anthropic, Cohere e Ollama. A...

suricata-rule-CVE-2025-53770

suricata-rule-CVE-2025-53770 Regole di rilevamento per CVE-2025-53770 root@kitploit: alert http $EXTERNALNET any - $HOMENET any msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "GET"; flow: established, toserver; http.uri; pcre:"//layouts/\d+/^?+.aspx/";...

C2-detection-manjusaka

"Manjusaka" C2 फ्रेमवर्क का पता लगाना C2 फ्रेमवर्क Manjusaka का पता लगाना: "Sliver और Cobalt Strike का एक चीनी समकक्ष" संदर्भ: डिटेक्शन लॉजिक का विवरण: https://corelight.com/blog/detecting-manjusaka-c2-framework Talos द्वारा लेख:...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy Proof of concept difensivo per CVE-2025-59287 WSUS. Il decoy emula gli endpoint web WSUS sulle porte 8530 e 8531, cattura l'intero corpo delle richieste HTTP e le intestazioni, salva le prove per l'analisi forense e include un harness di test Windows per validare la telemetria di...

sigint-hombre

sigint-hombre Autor: John Page — malvuln aka hyp3rlinx Copyright c 2026 Zweck: Generieren Sie abgeleitete Suricata-Erkennungsregeln aus Live-URLhaus-Bedrohungsindikatoren zur Laufzeit und stellen Sie sie auf der Security-Onion-Plattform für eine hochgradig abdeckende Echtzeit-Netzwerküberwachung...

pingback

Pingback-C2-Erkennung Ein Zeek-Paket und Suricata-Regeln zur Erkennung von ICMP-Ping-Tunneln, die vom Pingback-C2-Tool erstellt wurden. Zugehöriger Blogbeitrag: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation Der einfachste Weg, dieses Paket zu installieren, ist üb...

suricata-vedas

Suricata VEDAS Geração Autônoma Orientada por VEDAS de Regras Suricata para CVEs Propósito Este repositório serve como um espaço de validação colaborativo e aberto para regras Suricata geradas autonomamente pelo Sistema de Agregação de Dados de Vulnerabilidades e Exploits VEDAS da ARPSyndicate...

threat-intel

threat-intel Dieses Repository enthält IoCs im Zusammenhang mit den öffentlichen Threat-Intelligence-Blogbeiträgen von Volexity. Öffentliche Blogbeiträge zu diesen IoCs finden Sie auf der Volexity-Website. In der Vergangenheit wurde dieses Repository auch zur Speicherung von Tools verwendet, die...

suricata-detections

suricata-detections Network IDS signature development grounde...

SigInt-Hombre 1.0

SigInt-Hombre is a python script that generates derived Suricata detection rules from live URLhaus threat indicators at runtime and deploys them to the Security Onion platform for high-coverage real-time network monitoring...

SUSE CVE-2025-59149

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attributetype which is long with transforms can lead to a stack buffer overflow during Suricata startup or duri...

PT-2025-11967 · Suricata +1 · Suricata +1

Name of the Vulnerable Software and Affected Versions: Suricata versions affected versions not specified Description: The issue is related to high memory usage caused by the hashsize setting via rules in Suricata. Recommendations: At the moment, there is no information about a newer version that...

wolf-tools

wolf-tools Open source tools and scripts by Arctic Wolf:...

Exploit for CVE-2021-42292

CVE-2021-42292 This package will detect exploits of CVE-202...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Solarwinds Orion_Platform

This is a collection of Suricata rules and related information for various vulnerabilities. Here's a summary of the content: Rules: 1. Behinder3: Two rules for detecting Behinder3 PHP HTTP Request and Response. The rules set the behinder3 flowbit when the conditions are met. 2. Apache Nifi API RC...

Exploit for CVE-2021-1675

PrintNightmare CVE-2021-1675 This Zeek script detects succe...

suricata-rules

It is an offensive tool for cryptocurrency mining. The repository contains rules for detecting DNS queries to public cryptocurrency mining pool domains. The rules are designed to identify queries to various mining pool domains, including pool.minergate.com, pool.minexmr.com, opmoner.com,...