CVE-2026-20342

Cisco Secure Firewall Management Center (FMC) Software contains a low-privileged arbitrary file download vulnerability in a specific file download API. The root cause is unsanitized user input, allowing an authenticated, remote attacker to send a crafted HTTPS request and download arbitrary files...

physical-analyzer-scripts

physical-analyzer-scripts Scripts de Python de Cellebrite Physical Analyzer para ayudar a los analistas con funcionalidad extendida...

awesome-soc-analyst

awesome-soc-analyst 我们为 SOC 分析师和 SOC 分析师候选人收集了有用的资源。 该仓库由 LetsDefend 维护。欢迎在此添加新资源。 目录 书籍 恶意软件分析 实操实验室 钓鱼邮件分析 调查工具 网络日志来源 网络设备日志 Linux 防火墙日志 SMB 日志 Windows 防火墙日志 网络安全设备日志 IDS/IPS 日志 网络防火墙日志 Web 应用防火墙（WAF）日志 Web 服务器日志 Apache 日志 IIS 日志 Nginx 日志 取证痕迹 浏览器历史记录与缓存 DNS 缓存/历史记录 Hosts 文件...

log-add-http-post-bodies

Añadir extracto del cuerpo POST al registro HTTP Este script brinda a los analistas la capacidad de ver lo que se envía en los cuerpos de las peticiones POST HTTP. Lo consigue simplemente ampliando el registro HTTP. Instalación :: zkg refresh zkg install corelight/log-add-http-post-bodies Uso El...

stoq

快速开始 文档 安装 插件仓库 插件文档 概述 stoQ 是一个自动化框架，旨在简化分析师需要执行的繁琐且重复的任务。它使分析师和 DevSecOps 团队能够借助丰富且一致的数据结构，在不同数据源、数据库、解码器/编码器以及众多其他任务之间快速切换。stoQ 的设计目标是既具备企业级就绪性和可扩展性，同时又足够精简，适合个人安全研究人员使用。 为什么使用 stoQ？ 极其轻量级，设计以简洁为核心。 完整支持 AsyncIO。 提供广泛的公开可用插件。 stoQ 不对你的工作流做任何假设。分析师决定一切，从数据来源、扫描/解码/处理方式，到数据存储位置。...

Manati

ManaTI 项目 用于威胁直觉分析的机器学习 ManaTI 项目的目标是开发机器学习技术，以帮助直觉型威胁分析师加快发现新的安全问题。机器学习将通过寻找新的关系和推理来辅助分析。该项目将包括开发一个 Web 界面，供分析师与数据以及机器学习输出进行交互。 本项目部分由 Cisco Systems 支持。 有关该项目的更多信息，请访问 Stratosphere Lab 页面。 稳定版本 Mon Sep 3 12:24:26 CEST 2018: Version 0.12.0a Sun Aug 12 16:21:19 CEST 2018: Version 0.11.0a Mon Jan 2...

SOC-Analyst-Portfolio

🛡️ Allen Ace SOC Analyst | Threat Hunter | Detection Engineer Detect • Investigate • Respond • Defend Welcome This portfolio documents my hands-on cybersecurity journey through practical investigations, enterprise lab environments, detection engineering, digital forensics, malware analysis, threat...

stenographer

Stenographer Overview Stenographer is a full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files as disk fills up, and provides method...

soc-analyst-hub

🛡️ SOC分析师中心 — 一级工具包 一款免费、完全离线的交互式工具包，专为一级SOC分析师打造 — 涵盖事件响应、告警分类、威胁狩猎及分析师入职培训。零依赖。单个HTML文件。可在任意浏览器中打开。 🚀 在线演示 → 📦 内含内容 ⚡ 事件响应检查清单 针对最常见事件类型的逐步交互式检查清单。边工作边勾选步骤 — 进度自动保存。 钓鱼邮件调查（12步） 恶意软件/端点失陷（12步） 暴力破解/凭据攻击（12步） 数据泄露告警（12步） 可疑PowerShell活动（12步） 🔍 告警分类手册 决策树流程，用于评估、分类和升级告警 — 包含是/否分支逻辑和清晰的升级阈值。 大量登录失败...

EUVD-2026-62953

In Splunk Enterprise Security versions below 8.6.1, a user who holds the essanalyst Splunk Enterprise Security role could change User and Entity Behavior Analytics UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system...

EUVD-2026-62952

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, the Analyst Queue search filter handling does not validate filter field names before inclusion in SPL searches. A user with the mc_investigation_read capability can inject SPL, gaining access to all data and system integrity available to their s...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

PT-2026-78814

Name of the Vulnerable Software and Affected Versions Splunk Enterprise Security versions prior to 8.6.1 Description A user with a role containing the mc investigation read capability can perform Search Processing Language SPL injection via Analyst Queue search filters. This occurs because the...

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

PT-2026-70995

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor allows scheduling new collections via VQL queries in notebooks. While scheduling a new collection typically requires the COLLECT CLIENT permission, this requirement is not...

EUVD-2026-54184

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...