WinBypass

Windows UAC Bypass | Privilege Escalation Slui File Handler Hijack LPE - Windows 8-10 SluiHijackBypass.ps1 UAC Bypass via FodHelper - Windows 10 FodhelperBypass.ps1 UAC Bypass via Event Viewer - Windows 7 EventVwrBypass.ps1 Metasploit-Framework Module bypassuacsluihijack.rb copy...

EDRaser

EDRaser Usage Guide EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual. Automated Mode In automated mode, EDRaser scans the C class of a given address space of IPs...

CVE-2025-13401-XSS-Stored

Proof of Concept: Stored XSS in Autoptimize tags for images found in the content when image optimization or preloading is enabled. In version 3.1.13, the function uses a "blacklist" approach via pregreplace to remove specific attributes like title, alt, class, id, width, and height from the...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

CVE-2026-23918-poc

CVE-2026-23918 — Apache modhttp2 Double Free Affected: Apache HTTP Server 2.4.66 with modhttp2 + Event MPM Fixed in: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 HIGH — Unauthenticated Remote Code Execution possible CWE: CWE-415 Double Free What's the vulnerability modhttp2 in Apache 2.4.66 has a...

z9

z9 PowerShell Log Analyzer Japanese Abstract This tools detects the artifact of the PowerShell based malware from the eventlog of PowerShell logging. Online Demo Install git clone https://github.com/Sh1n0g1/z9 cd z9 pip install -r requirements.txt How to use usage: z9.py -h --output OUTPUT -s...

circuit-artist

A Digital Logic Simulation Game Every Circuit Is An Image 🎨 Check the Web Demo Game Rules Little pixel triangles are NANDs. Black pixels are background. Everything else is a wire. Screenshots 👀 | | !https://raw...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Broken Access Control Proof of concept for a missing-authorization flaw in MISP's bulk deletion flows for Event Reports and Sharing Groups. The deleteSelection handlers authorize each selected item with a callback that ignores the item and returns the caller'...

CVE-2025-58180

CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

cve-2022-46395-qemu

CVE-2022-46395 QEMU r36p0 Lab This repository contains a QEMU/no-Mali lab for reproducing the portable trigger condition of CVE-2022-46395 against the Arm Mali r36p0 driver lineage. The lab is intended for local vulnerability research and regression testing. It does not carry the Pixel-specific...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

sysmon-config

sysmon-config | A Sysmon configuration file for everybody to fork This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file should function as a great starting point for system change monitoring in a self-contained and accessible package...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

WEFFLES

WEFFLES WEFFLES is a way to build a fast, free, and effective threat hunting console using Windows Event Forwarding and PowerBI. You can find a full blog post on it at https://aka.ms/weffles but if you're impatient wefsetup.ps1 is the file to start with. Thanks, -Jessica...

zabbix-template-CVE-2020-1472

zabbix-template-CVE-2020-1472 Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472. Monitors event ID's 5827, 5828 & 5829. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472...

CVE-2020-1472-visualizer

CVE-2020-1472 Event Reader v1.1 8/27/2020 This script will: 1. Scan system evtx in input file folder for event 5827, 5828,5829,5830 and 5831, exact data fields, export to 582-.CSV. 2. Calls Excel to import resulting 582-.CSV, create pivot tables for common secure RPC analysis scenarios. Delete...