169 matches found
santa
Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...
MrKaplan
Mr.Kaplan Description MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user. This tool is inspired by MoonWalk, a similar tool for Uni...
Ghost-In-The-Logs
Ghost In The Logs This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here Usage You can grab the lastest release here Starting off Once you've got the latest version execute it with no arguments to see the avalible commands root@kitploit: $ gitl.exe...
Suborner
Suborner: The Invisible Account Forger What's this? A simple program to create a Windows account you will only know about : Create invisible local accounts without net user or Windows OS user management applications e.g. netapi32::netuseradd Works on all Windows NT Machines Windows XP to 11,...
Winshark
Winshark Wireshark plugin to work with Event Tracing for Windows Microsoft Message Analyzer is being retired and its download packages were removed from microsoft.com sites on November 25 2019. Wireshark have built a huge library of network protocol dissectors. The best tool for Windows would be...
sysmon-modular
sysmon-modular | Un repository di configurazioni Sysmon personalizzabile da tutti Questo è un repository di configurazioni per Sysmon di Microsoft Sysinternals scarica qui, strutturato in modo modulare per semplificare la manutenzione e la generazione di configurazioni specifiche. Tieni presente...
EventLogging
Hinweis Dieses Repository wird seit April 2024 nicht mehr gewartet. BHIS Hinweis Dieses Repository wird seit April 2024 nicht mehr gewartet. EventLogging Dieses Repository enthält Anleitungen zum Einrichten der Ereignisprotokollierung. Diese Anleitung ist in Abschnitte, Defensive Readiness...
Audix
root@kitploit: | / /| | / / / / / |// / // // // / / // |,/ ,/ // //|| ist ein PowerShell-Tool zur schnellen Konfiguration der Windows-Ereignisüberwachungsrichtlinien für Monitoring und Incident Response. Bitte beachten: Dieses Tool ändert nur die lokale Sicherheitsrichtlinie. Wenn es auf einem...
CVE-2026-61347
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...
CVE-2026-59137
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...
CVE-2026-59126
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
CVE-2026-59126
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
CVE-2026-59126 Windows Event Logging Service Elevation of Privilege Vulnerability
...
EUVD-2026-56611
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
CVE-2026-59126 Windows Event Logging Service Elevation of Privilege Vulnerability
...
CVE-2026-59126
The CVE refers to a race condition in Windows Event Logging Service where concurrent execution on a shared resource with improper synchronization can enable a local, authorized user to elevate privileges. Affected component: Windows Event Logging Service; root cause: race condition due to insuffi...
CVE-2026-61347
CVE-2026-61347 describes a buffer over-read in Windows Event Logging Service that allows an authorized attacker with LOW privileges and local access to disclose information. The CVSS 3.1 metrics indicate a MEDIUM base score (5.5), with LOCAL attack vector, low attack complexity, no user interacti...
CVE-2026-61347 Windows Event Logging Service Information Disclosure Vulnerability
...