epagneul

epagneul Epagneul è uno strumento per visualizzare e investigare i log degli eventi di Windows. Deploy Richiede che docker e docker-compose siano installati. Installazione root@kitploit: make Deploy offline Su una macchina connessa a internet, costruisci una release offline: root@kitploit: make...

APT-Hunter

APT-Hunter APT-Hunter ist ein Bedrohungsjagd-Tool für Windows-Ereignisprotokolle, das mit einer Purple-Team-Denkweise entwickelt wurde, um APT-Bewegungen zu erkennen, die im Meer von Windows-Ereignisprotokollen verborgen sind, und so die Zeit zur Aufdeckung verdächtiger Aktivitäten zu verkürzen...

EDRaser

EDRaser Bedienungsanleitung EDRaser ist ein leistungsstarkes Werkzeug zum Fernlöschen von Zugriffsprotokollen, Windows-Ereignisprotokollen, Datenbanken und anderen Dateien auf entfernten Rechnern. Es bietet zwei Betriebsmodi: automatisch und manuell. Automatischer Modus Im automatischen Modus...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI – ein PowerShell-Modul zur Bedrohungsjagd mithilfe von Windows-Ereignisprotokollen Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Beispiel-EVTX-Dateien befinden sich im Verzeichnis .\evtx Hinweis Sollte I...

ThreatHound

ThreatHound ThreatHound è uno strumento avanzato di cybersicurezza progettato per facilitare l'efficiente rilevamento e analisi delle minacce, dei log degli eventi di Windows. Offre un'interfaccia intuitiva per la gestione e l'analisi dei dati di sicurezza. Le caratteristiche principali includono...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

evtx-baseline

evtx-baseline Un repository che ospita esempi di log evtx goodware con installazioni di software campione e interazioni utente di base Donazioni win10-client.tgz di @phantinuss win11-client.tgz di @frack113 win7-x86.tgz di @pH-T win2022-evtx.tgz di @Neo23x0 win2022-ad.tgz di @frack113...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

PT-2026-35276

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

How-to Restore Lost Access to Cache Database After Using Custom SSL Certificate

Article Applicability This article is relevant only if the Veeam ONE deployment uses a custom SSL certificate, and not the one generated by the Veeam ONE installer. The error shown in the challenge section can also occur if the Veeam ONE Caching Service cannot access the PostgreSQL instance that...

CVE-2025-34091

A padding oracle vulnerability exists in Google Chrome’s AppBound cookie encryption mechanism due to observable decryption failure behavior in Windows Event Logs when handling malformed ciphertext in SYSTEM-DPAPI-encrypted blobs. A local attacker can repeatedly send malformed ciphertexts to the...

CVE-2025-34091

Rejected reason: Neither filed by Chrome nor a valid security vulnerability...

CVE-2025-34091

...

PVS Server: Windows Event logging for UEFI target Devices Boot Time inaccurate

The customer had built a new UEFI based vdisk and deployed it to production. The customer subsequently observed that the PVS Servers were recording a clearly inaccurate boot time, of millions of minutes, in Windows Event logs when target devices were booting. Example inaccurate boot time logged i...

SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Vulnerability

Exploit Title: SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Exploit Author: Milad Karimi Ex3ptionaL Contact: email protected Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Vendor Homepage: https://www.kiwisyslog.com/ Softwar...

NoArgs - Tool Designed To Dynamically Spoof And Conceal Process Arguments While Staying Undetected

NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows internals on the go. This allows NoArgs to alter process arguments discreetly. Default Cmd: Windows Event Logs...

IBM QRadar WinCollect Agent Resource Management Error Vulnerability

IBM QRadar WinCollect Agent is an agent program from International Business Machines IBM for collecting and sending Windows event logs. A resource management error vulnerability exists in IBM QRadar WinCollect Agent that stems from vulnerability to server-side request forgery attacks. No detailed...

Persistence – Event Log

Windows Event logs are the main source of information for defensive security teams to identify threats and for administrators to troubleshoot errors. The logs are… Continue reading - Persistence - Event Log...