pyrdp

PyRDP PyRDP is a Python Remote Desktop Protocol RDP Monster-in-the-Middle MITM tool and library. It features a few tools: RDP Monster-in-the-Middle Logs plaintext credentials or NetNTLM hashes used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the...

Attacker-Group-Predictor

Attacker-Group-Predictor The tool predicts attacker groups from techniques and softwares used. It searches based on the MITRE ATT&CK™ framework How it works? 1- Collect data from https://attack.mitre.org/ about attacker groups 2- Get data from user about attack 3- Compare data and create result...

stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...

gitxray

Welcome to Gitxray Gitxray short for Git X-Ray is a multifaceted security tool designed for use on GitHub repositories. It can serve many purposes, including OSINT and Forensics. gitxray leverages public GitHub REST APIs to gather information that would otherwise be very time-consuming to obtain...

EternalLiberty

EternalLiberty Description This repository contains all Threat Actor aliases used by different Threat Intelligence companies in their reports. Objectives This allows to find the Threats Actors that you want survey or search in getting the name used by different companies or for attribution of...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator Focusing on UNC2452 TTPs Overview This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so calle...

CVE-2021-3122-Details

CVE-2021-3122-Details Blog Post on how we found a CVE in AlohaPOS. https://www.sentinelone.com/blog/cve-2021-3122-how-we-caught-a-threat-actor-exploiting-ncr-pos-zero-day/...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

Microweber Information Disclosure

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0281 info: name: Microweber Information Disclosure author: pikpikcu severity: high description: Microweber contains a...

exim-cve-2019-10149-data

Exim CVE Data Collection Data Collection Related to Exim Vulnerabilities CVE-2019-10149, CVE-2019-15846, CVE-2019-16928 CVE Announcement: https://vulners.com/cve/CVE-2019-10149 Exploit Details: https://www.exploit-db.com/exploits/46974 Issue Timeline: https://seclists.org/fulldisclosure/2019/Jun/...

redxor

Linux Malware C2 'RedXOR' - an example detection This package serves as a demonstration of how Zeek can be used to detect the Linux backdoor "redXOR" using state based methods. References: Corelight blog...

EUVD-2026-110532

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs

An adversary brain is an LLM-based model of a threat actor's behavior, held as an evolving logical signature: a hypothesis with enough structure that data can test it continuously, without a person re-interpreting it each time. Rather than any single observation, such as an IoC Indicator of...

Actor Component Protected Information Access

The vulnerability in the Actor component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Actor Component Protected Information Access

The vulnerability in the Actor component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

CVE-2026-113296

A flaw was found in chromium-browser. A remote attacker could exploit a memory corruption vulnerability in the Actor component by convincing a user to open a specially crafted HTML page. Successful exploitation allows the attacker to read memory within the sandbox an isolated security environment...

CVE-2026-113162

A flaw was found in chromium-browser. Due to improper input validation in the Actor component, a remote attacker can potentially execute arbitrary code within the browser's restricted sandbox environment by convincing a user to view a specially crafted HTML page...

CVE-2026-113083

A flaw was found in the Actor component of Google Chrome. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted HTML page, triggering memory corruption. Successful exploitation allows the attacker to execute arbitrary code within the browser's...

SUSE CVE-2026-113041

Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...