wazuh

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

labs-releases

Elastic Security Labs - Releases This repository is the home to tools, configuration extractors, and other contributions to the infosec, threat hunting, malware researcher, and intelligence analysis community. At Elastic, we believe that being open and transparent is critical for the success of u...

drs-malware-scan

Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints. Signature-based antivirus alone is insufficient as moder...

agent-skills

Elastic Agent Skills Elastic Agent Skills — built by the people who built Elastic — deliver native platform expertise directly to your AI coding agent. This is the official Agent Skills library, compatible with agentic IDEs such as Cursor, GitHub Copilot, Windsurf, Gemini CLI, and more. Skills...

edrEvasionWorkshop

edrEvasionWorkshop Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” , presented at DEF CON 34 and BSidesLV 2026. This workshop explores custom malware development, EDR Architecture & Evasion, C2 customization, and kernel-level techniques using...

detectree

Detectree Detectree is a data visualisation tool for blue teams. It provides a graphical representation of detection data, which allows an analyst generate almost instant opinions about the nature of the underlying activity and to understand complex relationships between the data points...

ecs-mapping

Corelight ECS Ingest Pipeline The repository is compromised of Ingest Pipeline files required to be used with the installer script in the repository https://github.com/corelight/ecs-templates The installer in that repository will download the files from this repository therefore using this...

securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

intel471-threat-hunting-cve-2023-46604

Intel 471 Threat Hunting Workshop – CVE-2023-46604 Investigation Overview This repository documents my first hands-on experience with Intel 471’s Intelligence-Driven Threat Hunting Workshop focused on CVE-2023-46604. Through this practical workshop, I investigated how attackers leveraged a critic...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...

dufflebag

Dufflebag Dufflebag is a tool that searches through public Elastic Block Storage EBS snapshots for secrets that may have been accidentally left in. You may be surprised by all the passwords and secrets just laying around! The tool is organized as an Elastic Beanstalk "EB", not to be confused with...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

cve-2021-22146

cve-2021-22146 I found during a internal pentest a vulnerability on elastic ECE. Elasticdump is a PoC for CVE-2021-22146 to dump database from elastic ece from 7.10.0 to 7.13.3 https://www.exploit-db.com/exploits/50152 Collaborators: Mario Díaz Caldera...

ghostbuster

Table of Contents Table of Contents Ghostbuster The problem Project Features Installing Ghostbuster Using Ghostbuster Example Output Setting up your AWS accounts Setting up Cloudflare Optional Authors License Ghostbuster Eliminate dangling elastic IPs by performing analysis on your resources with...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...

elastic-search-email-extractor

Email Extractor This Go program is designed to extract email addresses from a list of Elastic Search Databases. It takes in a list of URLs and will search the Database of each URL to find email addresses. Install go install github.com/RandomRobbieBF/elastic-search-email-extractor@latest Usage To...

Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

Elasticsearch 7.10.0-7.13.3 - Information Disclosure

ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as...

Kibana Timelion - Arbitrary Code Execution

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands...