rastrea2r

.. image:: https://github.com/rastrea2r/rastrea2r/blob/master/logo.png :align: center :alt: 标志 .. image:: https://travis-ci.org/rastrea2r/rastrea2r.svg?branch=master :target: https://travis-ci.org/rastrea2r/rastrea2r.svg?branch=master :alt: 主分支的 travis-ci 状态 .. image::...

uac

类 Unix 系统证据收集工具 UAC 关于 • 文档 • 主要特性 • 支持的操作系统 • 使用方法 • 贡献指南 • 支持 • 许可协议 🔎 关于 UAC UAC（Unix-like Artifacts Collector） 是一款功能强大且可扩展的事件响应工具，专为取证调查人员、安全分析师和 IT 专业人员设计。它能自动从广泛的类 Unix 系统（包括 AIX、ESXi、FreeBSD、Linux、macOS、NetBSD、NetScaler、OpenBSD 和 Solaris）中收集证据。 无论您是在处理入侵事件、进行取证调查还是执行合规检查，UAC...

Fennec

Fennec 🦊 fennec 是一个使用 Rust 编写的工件收集工具，用于在基于 nix 的系统上进行应急响应。fennec 允许你编写一个配置文件，其中包含如何收集工件。 特性 🌟 🦀 单个静态编译的二进制文件 🔬 执行任意 osquery SQL 查询 💻 执行系统命令并解析其输出 📚 使用正则表达式解析任何文本文件 🧰 能够收集系统日志和文件 🧱 以结构化方式返回数据 🃏 支持多种输出格式（JSONL、CSV 和 KJSON） 🤸‍♀️ 灵活的配置文件 💾 直接写入 ZIP 文件以节省空间 ⚡ 速度非常快！ 测试 🧪 操作系统详情| 架构| 成功?| 详情...

persisthunt

Detección de Persistencia, Búsqueda y Recopilación de Artefactos en Linux Resumen Uso Ejemplos de Detecciones Tabla de Técnicas Resumen persisthunt.sh ayuda a acelerar las investigaciones recolectando artefactos relacionados con persistencia específicos y destacando patrones sospechosos comúnment...

whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

whids

重要提示： 本README及其他文档尚未更新以反映最新测试版（因发生了大量改动）。所有内容将在稳定版发布时更新（参见下一个版本路线图）。欢迎自行运行测试版，如有问题请提出。 是什么 EDR （端点检测与响应），其工件采集由检测驱动。检测引擎基于之前的项目Gene构建，专门用于将Windows事件与用户定义的规则进行匹配。 “由检测驱动的工件采集”是什么意思？ 这意味着告警可以直接触发一些工件采集（文件、注册表、进程内存）。这样你可以确保在能够采集工件的尽早时刻（近乎实时）就进行采集。...

Fastir_Collector

FastIR Collector 我们已改变实时取证采集的方法，因此 FastIR Collector 不再维护。推荐使用我们的新版FastIR Artifacts 收集器 替代 概念 该工具在实时 Windows 系统上收集不同的痕迹，并将结果记录在 csv 或 json 文件中。通过对这些痕迹的分析，可以检测到早期的入侵迹象。 下载 二进制文件可在本项目的 发布页面 中找到。 要求 pywin32 python WMI python psutil python yaml construct distorm3 hexdump pytz 或者，reqs.pip 文件中提供了 pip...

ForensicMiner

ForensicMiner v1.4 "ForensicMiner，重新定义 DFIR 自动化" 创建和维护者：Eilay Yosfan 什么是 ForensicMiner？ ForensicMiner 是一款基于 PowerShell 的 DFIR 自动化工具，彻底改变了数字调查领域。它专为提高效率而设计，能够从 Windows 机器自动收集工件和证据。与 Falcon Crowdstrike RTR 和 Palo Alto Cortex XDR Live Terminal 的兼容性，加上其快速性能和友好的用户界面，使 ForensicMiner...

FLAIR

F-Secure Lightweight Acquisition for Incident Response FLAIR Este documento describe el propósito y el funcionamiento básico del script de adquisición FLAIR. Propósito Durante la investigación de incidentes en el entorno de los clientes, hay ocasiones en las que no hay un EDR desplegado del que e...

Exploit for CVE-2025-14847

Eric Capuano^1 posted an excellent blog regarding Mongo...

Rapid7 Velociraptor < 0.74.3 Privilege Escalation

The version of Rapid7 Velociraptor installed on the remote host is prior to 0.74.3. It is, therefore, affected by privilege escalation vulnerability: - Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run...

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

macos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily Aftermath by Jamf Threat Labs...

VulnCheck KEV: CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

Rapid7 Velociraptor Incorrect Default Permissions Vulnerability

Rapid7 Velociraptor contains an incorrect default permissions vulnerability that can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the Admin.Client.UpdateClientConfig artifact. An attacker can gain elevated privileges and execute arbitrary commands by exploiting insufficient permission checks when collecting artifacts from endpoint...

PT-2025-26266

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The issue concerns the Velociraptor's artifact collection feature, which allows users to collect and execute VQL queries packaged into artifacts from endpoints. These artifacts typically...

CVE-2023-2226

Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to introduce malicious files to the system a...

Cross-site Scripting (XSS)

github.com/velocidex/velociraptor is vulnerable to cross-site scripting. The vulnerability exists in multiple functions in artifacts/syntax.js because the variables are not properly escaped in artifact collection report which allows an attacker to inject and execute malicious javascript...

CVE-2022-35630 Unsafe HTML Injection in Artifact Collection Report

A cross-site scripting XSS issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2...

Fennec - Artifact Collection Tool For *Nix Systems

fennec is an artifact collection tool written in Rust to be used during incident response on nix based systems. fennec allows you to write a configuration file that contains how to collect artifacts. Features A single statically compiled binary Execute any osquery SQL query Execute system command...