ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...

LSMS

Linux Security and Monitoring Scripts These are a collection of security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Each script works on its own and is independent of other scripts. The scripts can be set up to either...

Fastir_Collector

FastIR Collector We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our newFastIR Artifacts collector instead Concepts This tool collects different artefacts on live Windows and records the results in csv or json files...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner IPアドレスをスキャンし、HTMLページから身代金要求メモを取得して文字列を比較することで、ESXiが侵害された兆候を検出するプログラムです。 必要条件 Python 3.x requests BeautifulSoup tqdm colorama インストール パッケージマネージャーpipを使用して必要なパッケージをインストールします。 root@kitploit: pip install requests pip install bs4 pip install tqdm pip install colorama 使い方 Python...

CVE-2025-57819-ioc-check

CVE-2025-57819-ioc-check 説明 CVE-2024-6387-ioc-check は、FreePBXサーバー上で endpoint ユーザーは、FreePBXの最新サポートバージョン（現在は15、16、17）にアップグレードし、インストールされている「endpoint」モジュールが最小パッチバージョンを満たしていることを確認する必要があります。自動アップデートが設定されていないシステム、または手動でアップデートしたい場合は、管理者コントロールパネルのメニュー Admin - Module Admin...

citrix-ioc-scanner-cve-2023-3519

CVE-2023-3519 用侵害指標スキャナー このリポジトリには、CVE-2023-3519 に関連する Citrix ADC アプライアンスの侵害を検出するためのユーティリティが含まれています。 このユーティリティとそのリソースは、Mandiant の調査中に収集された侵害指標をエンコードしています。 詳細については、このツールのリリースを発表したブログ記事 をご覧ください。 要約すると、このユーティリティは以下を行います。 既存の侵害を特定するためのベストエフォート型の処理を実行します。 以下のことは行いません 。 侵害を常に 100% 特定することはできません。...

ioc-scanner-CVE-2019-19781

Escáner de indicadores de compromiso para CVE-2019-19781 Este repositorio contiene una utilidad para detectar compromisos de los dispositivos Citrix ADC relacionados con CVE-2019-19781. La utilidad y sus recursos codifican indicadores de compromiso recopilados durante las investigaciones de FireE...

drupal-check

drupal-check 这是一个用于在Cpanel Apache和默认Apache配置中进行日志挖掘的脚本。 它会查找潜在入侵的迹象，但并非确凿证据，旨在使调查人员的分析工作更加简便。...

CVE-2019-19781

CVE-2019-19781 Script de triaje de ataques CVE-2019-19781 El script puede ejecutarse en sus dispositivos Citrix ADC afectados para ayudar a determinar si se ha producido un compromiso. Capturará rápidamente cualquier comando o archivo asociado que se haya utilizado como parte del ataque a menos q...

AgentShield: Deception-Based Compromise Detection for Tool-Using LLM Agents

Defenses against indirect prompt injection IPI in tool-using LLM agents share two structural weaknesses. First, they all attempt to prevent attacks rather than detect the compromises that slip through. Second, they have only been evaluated in English, leaving users of low-resource languages such ...

Identity Threat Detection and Response Solution Guide

The Emergence of Identity Threat Detection and Response Identity Threat Detection and Response ITDR has emerged as a critical component to effectively detect and respond to identity-based attacks. Threat actors have shown their ability to compromise the identity infrastructure and move laterally...

MAL-2024-141 Malicious code in lunar-sb.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387a2f7e6dc2c3022b63ec2ea875bfdbcc6ee0fd07b1ff68475859ea718566d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-46805

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks. Recent assessments: cbeek-r7 at January 11, 2024 10:43am UTC reported: CVE-2023-46805 is an...

Citrix Bleed widely exploited, warn government agencies

In a joint cybersecurity advisory, the Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI, along with other international agencies, warn that ransomware gangs are actively exploiting the Citrix Bleed vulnerability. Affiliates of at least two ransomwa...

Zero address Pauser assignment

Lines of code Vulnerability details Impact By exploiting the unpauser role's access to call setPauser with any address input, an attacker could permanently disable a core functionality pausing/unpausing the token by assigning a zero address as the pauser. No pauser would mean no ability to freeze...

Access Control Unauthorized access to restricted functions setWithdrawalDelayBlocks

Lines of code Vulnerability details Impact By exploiting the owner's role through social engineering, an attacker could theoretically gain indirect control over any functions that require owner authorization. Specifically, the ability to manipulate withdrawal delays and other critical security...

GHSA-35JJ-VQCF-F2JF Hidden fields can be leaked on readable collections in Payload

Details If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Affected versions: 1.7.0 Workarounds If you are unable to update, you can write a beforeOperation hook to remove where queries...

MAL-2023-958 Malicious code in waline-magic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a36651e1c228b2c1cc270f4d650d20db1da7126756f6ae78b407b803174a517 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-5W8R-8PGJ-5JMF matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

Impact An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of th...

Kaseya Patches Imminent After Zero-Day Exploits

UPDATE 3 The worldwide July 2 attacks on the Kaseya Virtual System/Server Administrator VSA platform by the REvil ransomware gang turn out to be the result of exploits for at least one zero-day security vulnerability, and the company is swinging into full mitigation mode, with patches for the...