deadair

Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly · Featured in tl;dr s...

sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

studio

ShipSec Studio Open-Source Security Workflow Orchestration Platform. ShipSec is currently in active development. We are optimizing the platform for stable production use and high-performance security operations. ShipSec Studio provides a visual DSL and runtime for building, executing, and...

CVE-2024-3400

CVE-2024-3400 Exploit for GlobalProtect CVE-2024-3400 This exploit targets the original vulnerability, so the firewall must be running a vulnerable PAN-OS version and must have telemetry enabled. Ref: https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/ Sample...

rustinel

Rustinel Open-source endpoint detection for Windows, Linux, and macOS. Native telemetry to Sigma, YARA, IOC detection, and SIEM-ready alerts. Written in Rust. Website | Docs | Download | SIEM demos Quick Start Rustinel ships release archives with a binary, default config, demo rules, and a logs/...

gdid-reversal

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered -8a2be2 -0078d6 How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted. TL;DR !NOTE Listed...

tenzir

Data Pipelines for Security Teams Collect, transform, enrich, and route your telemetry—all in one place. What is Tenzir? Tenzir is the data pipeline engine for security teams. If you need to collect, parse, shape, normalize, aggregate, store, query, and route security telemetry data at scale,...

openedr

OpenEDR We at OpenEDR believe in creating a cybersecurity platform with its source code openly available to the public, where products and services can be provisioned and managed together. EDR is our starting point. OpenEDR is a full-blown EDR capability. It is one of the most sophisticated,...

ezEmu

ezEmu ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an "offensive framework for blue teamers ", ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry. Windows See /Linux for ELF ezEmu is compiled as...

DroneXtract

About DroneXtract is a comprehensive digital forensics suite for DJI drones made with Golang. It can be used to analyze drone sensor values and telemetry data, visualize drone flight maps, audit for criminal activity, and extract pertinent data within multiple file formats. Preview Features...

apache_skywalking

Protocols There are two types of protocols list here. Probe Protocol. Include the descriptions and definitions about how agent send collected metrics data and traces, also the formats of each entities. Query Protocol. The backend provide query capability to SkyWalking own UI and others. These...

SymaX5SW-Rx-Tx

SymaX5SW Rx and Tx Research carried out on a SYMA X5SW Drone with three defined objectives. 1. Intercept the telemetry of the Drone and display it in a graphical interface in real-time. 2. Create a transmitter command control, using RF, Arduino modules and C code. 3. Intercept the video stream of...

LOLSpoof

LOLSpoof LOLSpoof is a an interactive shell program that automatically spoof the command line arguments of the spawned process. Just call your incriminate-looking command line LOLBin e.g. powershell -w hidden -enc ZwBlAHQALQBwAHIAbwBjAGUA.... and LOLSpoof will ensure that the process creation...

TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

CVE-2021-22005

CVE-2021-22005 VMware vCenter RCE CVE-2021-22005 verificador masivo de una línea cat vmwarecenters.txt | while read S do; do curl --connect-timeout 15 --max-time 30 --silent --insecure --user-agent "vAPI/2.100.0 Java/1.8.0261 Linux; 4.19.160-6.ph3; amd64" -X POST...

trust-my-agent-ai

🛡️ TrustMyAgent Security bodyguard for OpenClaw agents Website • Trust Center • Quick Start • Contributing An EDR-like security agent for OpenClaw agents. Runs 41 security checks across 14 domains, calculates a trust score 0-100, and sends telemetry to a centralized Trust Center dashboard where...

sysflow

SysFlow: 云原生系统遥测管道 此仓库托管所有 SysFlow 项目的文档和问题追踪。 快速参考 文档 : SysFlow 文档 获取帮助的渠道 : SysFlow 社区 Slack 提交问题的位置 : GitHub 问题追踪器 此描述的来源 : 仓库的 readme 历史 Docker 镜像 : docker hub | GHCR 什么是 SysFlow？ SysFlow 遥测管道是一个用于监控云工作负载并创建性能和安全分析的框架。该项目的目标是构建系统遥测所需的所有基础设施，以便用户能够专注于在可扩展的、通用的开源平台上编写和分享分析。遥测管道的核心是一种名为 SysFlow...

FRAGNESIA-Charan-cve-2026-46300

Arquitectura Charantej: Laboratorio de Staging de Contenedores Hardened y Telemetría de Llamadas al Sistema Un marco de trabajo empresarial de defensa en profundidad para la contención de contenedores y telemetría de seguridad en tiempo de ejecución. Diseñado desde la perspectiva de un Arquitecto...

Umbra

Este es el repositorio para la distribución del navegador Umbra. El código fuente de Umbra no se encuentra aquí, construimos Umbra con un script llamado fern.js. Nuestro sistema de compilación se puede encontrar aquí: https://github.com/openconstruct/user-agent-desktop Umbra es un navegador de...

AtomicTestHarnesses

AtomicTestHarnesses AtomicTestHarnesses es una biblioteca que simula y valida la ejecución de técnicas de ataque. Consiste en un módulo de Powershell para ejecutar técnicas de ataque en Windows y también un paquete de Python para ejecutarlas en macOS y Linux Los detalles de una técnica pueden...