APT-Hunter

APT-Hunter APT-Hunter es una herramienta de caza de amenazas para registros de eventos de Windows, creada con la mentalidad de equipo púrpura para detectar movimientos de APT ocultos en el mar de registros de eventos de Windows, reduciendo el tiempo para descubrir actividad sospechosa. APT-Hunter...

epagneul

epagneul Epagneul es una herramienta para visualizar e investigar registros de eventos de Windows. Despliegue Requiere tener instalados docker y docker-compose. Instalación root@kitploit: make Despliegue sin conexión En una máquina conectada a internet, construye una versión sin conexión:...

ThreatHound

ThreatHound ThreatHound es una herramienta avanzada de ciberseguridad diseñada para facilitar la detección y análisis eficiente de amenazas, registros de eventos de Windows. Ofrece una interfaz fácil de usar para gestionar y analizar datos de seguridad. Las características principales incluyen...

EDRaser

EDRaser Guía de uso EDRaser es una herramienta poderosa para eliminar de forma remota registros de acceso, registros de eventos de Windows, bases de datos y otros archivos en máquinas remotas. Ofrece dos modos de operación: automatizado y manual. Modo Automatizado En el modo automatizado, EDRaser...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - un módulo de PowerShell para la caza de amenazas a través de registros de eventos de Windows Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Los archivos EVTX de muestra están en el directorio .\evtx Not...

evtx-baseline

evtx-baseline A repository hosting example goodware evtx logs containing sample software installation and basic user interaction Donations win10-client.tgz by @phantinuss win11-client.tgz by @frack113 win7-x86.tgz by @pH-T win2022-evtx.tgz by @Neo23x0 win2022-ad.tgz by @frack113...

EVTX-ATTACK-SAMPLES

Windows EVTX Samples 200 EVTX examples: This is a container for windows events samples associated to specific attack and post-exploitation techniques. Can be useful for: Testing your detection scripts based on EVTX parsing Training on DFIR and threat hunting using event logs Designing detection u...

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

PT-2026-35276

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

How-to Restore Lost Access to Cache Database After Using Custom SSL Certificate

Article Applicability This article is relevant only if the Veeam ONE deployment uses a custom SSL certificate, and not the one generated by the Veeam ONE installer. The error shown in the challenge section can also occur if the Veeam ONE Caching Service cannot access the PostgreSQL instance that...

CVE-2025-34091

A padding oracle vulnerability exists in Google Chrome’s AppBound cookie encryption mechanism due to observable decryption failure behavior in Windows Event Logs when handling malformed ciphertext in SYSTEM-DPAPI-encrypted blobs. A local attacker can repeatedly send malformed ciphertexts to the...

CVE-2025-34091

Rejected reason: Neither filed by Chrome nor a valid security vulnerability...

CVE-2025-34091

...

PVS Server: Windows Event logging for UEFI target Devices Boot Time inaccurate

The customer had built a new UEFI based vdisk and deployed it to production. The customer subsequently observed that the PVS Servers were recording a clearly inaccurate boot time, of millions of minutes, in Windows Event logs when target devices were booting. Example inaccurate boot time logged i...

SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Vulnerability

Exploit Title: SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Exploit Author: Milad Karimi Ex3ptionaL Contact: email protected Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Vendor Homepage: https://www.kiwisyslog.com/ Softwar...

NoArgs - Tool Designed To Dynamically Spoof And Conceal Process Arguments While Staying Undetected

NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows internals on the go. This allows NoArgs to alter process arguments discreetly. Default Cmd: Windows Event Logs...