Hunting-Queries-Detection-Rules

Consultas KQL para Sentinel y Defender KQL para Defender XDR, Microsoft Sentinel y otras soluciones de Microsoft El propósito de este repositorio es compartir consultas KQL que puedan ser utilizadas por cualquier persona y sean comprensibles. Estas consultas están diseñadas para aumentar la...

Threat-Hunting

Caza de Amenazas | Ingeniería de Detección Colección de consultas de caza de amenazas y detección para: CrowdStrike Falcon usando CQL – CrowdStrike Query Language Microsoft Defender XDR usando KQL – Kusto Query Language Diseñado para detectar procesos sospechosos, comportamientos de red anómalos,...

Cortex-XDR-Config-Extractor

Cortex XDR Config Extractor ⚠️ Para más información, visite https://laokoon-security.com/cortex-xdr-config-exctractor/ actualmente solo en alemán Esta herramienta está diseñada para ser utilizada durante evaluaciones de Red Team y para auditar la configuración de XDR. Con esta herramienta es...

azure-sentinel-detection-engineering

Ingeniería de detección en Azure Sentinel Ingeniería de detección en un entorno Microsoft Sentinel y Defender XDR en producción que opero. Nueve reglas de análisis personalizadas se reparten entre tres planos, cada una mapeada a MITRE ATT&CK y probada de extremo a extremo: una acción controlada...

CVE-2021-44228

CVE-2021-44228 Este repositorio contiene scripts comunitarios modificados relacionados con CVE-2021-44228 adaptados a entornos EDR. Los scripts fueron modificados para ser compatibles con los requisitos adicionales de otras tecnologías. Consulte los repositorios enlazados para obtener una versión...

GO-RPCBOMB

Descripción: CVE-2017-8779 rpcbind hasta 0.2.4, LIBTIRPC hasta 1.0.1 y 1.0.2-rc hasta 1.0.2-rc3, y NTIRPC hasta 1.4.3 no consideran el tamaño máximo de datos RPC durante la asignación de memoria para cadenas XDR, lo que permite a atacantes remotos causar una denegación de servicio consumo de...

KQL-threat-hunting-queries

Caza/detección de amenazas mediante consultas KQL root@kitploit: | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE 27 de enero: Tras casi un año de contribuciones, este repositorio...

redsun-bluehammer-undefend-detection-pack

RedSun, BlueHammer, UnDefend, and CrossFamily Detection Pack IMPORTANT: All code and detection logic in this repository is AI-generated. There is no guarantee that these scripts are correct, complete, safe, or suitable for any environment. Use these scripts entirely at your own risk. The reposito...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098906)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098906 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinex...

Astra Linux – Vulnerability in krb5

The file “lib/kadm5/kadmrpcxdr.c” in MIT Kerberos 5 also known as krb5 before versions 1.20.2 and 1.21.x before version 1.21.1 exposes an uninitialized pointer. A remotely authenticated user can cause a Kadmind crash. This occurs because the function xdrkadm5principalentrec does not validate the...

Linux Distros Unpatched Vulnerability : CVE-2026-72217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and th...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099937)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099937 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinex...

SUSE CVE-2026-53398

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

CVE-2026-53398

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

CVE-2026-53398 NFSD: Fix SECINFO_NO_NAME decode error cleanup

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

EUVD-2026-45520

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

CVE-2026-0276

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user...

CVE-2026-0276 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user...

CVE-2026-0276

CVE-2026-0276 concerns Palo Alto Networks Cortex XDR Broker VM. The connected sources describe a privilege-escalation issue in the VM related to insecure privilege management that would allow a locally authenticated attacker to escalate to root privileges. There are no specific version numbers, r...

SUSE CVE-2026-45870

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: authgss: fix memory leaks in XDR decoding error paths The gssxdecctx, gssxdecstatus, and gssxdecname functions allocate memory via gssxdecbuffer, which calls kmemdup. When a subsequent decode operation fails, these...