Detection

About This repository contains detection rules and IOCs that we were able to extract and use in the context of our DFIR projects and malware analyses. Contact Follow us on Twitter: https://twitter.com/SIFalconTeam...

IoC_Attack_ESXi_Feb_2023

IoCAttackESXiFeb2023 Collection of IoCs available and related to attacks on ESXi infrastructures that occurred as of Friday February 3, 2023. News Here are some references regarding the attack: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/...

SupplyChainAttacks

Firmware Supply Chain Attacks This repository provides a curated and comprehensive collection of documented firmware supply chain attacks discovered or investigated by Binarly REsearch team. Maintained by Binarly, the project serves as an educational and reference resource for cybersecurity...

Awesome-BEC

Awesome-BEC Repository of attack and defensive information for Business Email Compromise investigations Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...

MAL-2026-16004 Malicious code in ulid-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cde9990177f51fd4637a17f48d850c61f3ade933fe3fce078d5846125a5fa01 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ulid-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cde9990177f51fd4637a17f48d850c61f3ade933fe3fce078d5846125a5fa01 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

POC-CVE-2019-5736

RunC-CVE-2019-5736 Video : https://bit.ly/2WqvILb Blog Post : www.idealhax.blogspot.com/2020/05/breaking-out-of-docker-via-runc.html Here, I like to mention that the original developer of this exploit is Yuval Avrahami at Twistlock Labs. Running the POCs Note that running the POCs will overwrite...

CVE-2026-17207

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow...

EUVD-2026-71481

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow...

CVE-2026-17207

CVE-2026-17207 is a buffer overflow (CWE-787: Out-of-bounds Write) in the Network File System (NFS) component of IBM i versions 7.3, 7.4, 7.5, and 7.6. A remote, unauthenticated attacker can trigger it over the network to cause a denial of service and compromise data integrity . NVD rates it CVSS...

MAL-2026-15944 Malicious code in @crysnovax/baileys-fixed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bca343c567c4a163c81912649019e99d22070a069b1c7e174a16659f6e41469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

iocs

Zscaler ThreatLabz IOCs This repository contains Indicators of Compromise IOCs from the Zscaler ThreatLabz team. Follow us on Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...

CVE-2026-6471

creationtimestamp| type| source ---|---|--- 2026-09-04 12:12:46+00:00| seen| https://bsky.app/profile/devopsbriefly.bsky.social/post/3muowrtw6ak2d 2026-09-04 12:15:13+00:00| seen| https://bsky.app/profile/javascriptbriefly.bsky.social/post/3muowwa36x62s 2026-09-04 12:16:13+00:00| seen|...

ioc

IoC Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs. Licenses The content of this repository is released under the Detection Rule License DRL 1.1...

GOSINT

GOSINT - Marco de recopilación y procesamiento de inteligencia de amenazas de código abierto El framework GOSINT es un proyecto utilizado para recopilar, procesar y exportar indicadores de compromiso IOCs de alta calidad. GOSINT permite a un analista de seguridad recopilar y estandarizar...

Unit42-Threat-Intelligence-Article-Information

Unit42-Threat-Intelligence-Article-Information This is the repository for indicators of compromise IOCs and other data supporting threat intelligence articles posted on the Palo Alto Networks Unit 42 website...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2019-9810

CVE-2019-9810 Exploit para Firefox en Windows CVE-2019-9810 es una vulnerabilidad que fue encontrada y explotada en Pwn2Own 2019 por Richard Zhu y Amat Cama. Afecta al motor JavaScript de Mozilla, SpiderMonkey, y fue utilizada para comprometer el renderizador. El problema fue solucionado en...

CVE-2025-57819-ioc-check

CVE-2025-57819-ioc-check Description CVE-2024-6387-ioc-check is a lightweight, efficient tool designed to identify IoCs on freepbx servers with any of endpoint Users should upgrade to the latest supported versions of FreePBX currently 15, 16, and 17 and confirm that the installed "endpoint" modul...

The vulnerability of the nft_exthdr_init() function in the net/netfilter/nft_exthdr.c module of the netfilter component of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nftexthdrinit function in the net/netfilter/nftexthdr.c module of the netfilter component of the Linux operating system is related to the access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...