LogHound

LogHound 用于 BloodHound 映射的后利用 EVTX 分析器 LogHound 收集并解析 Windows 安全事件日志（.evtx），提取身份验证事件、会话数据和登录元数据，以便导入 BloodHound 并提供更深入的对抗性遥测信息。 设计理念与概述 LogHound 的构建是为了解决红队和网络渗透测试人员的一个特定问题：如何在不牺牲操作安全性的前提下，高效追踪横向移动目标、识别活跃用户会话并确定机器的最终归属。 Active Directory 域控制器上的安全事件日志文件（Security.evtx）可能达到数...

Grafiki

Grafiki Grafiki ist ein Django-Projekt über Sysmon und Graphen, vorerst. Meiner Meinung nach sind EventViewer, Elastic und sogar Kibana nicht graphisch genug. Die aktuellen Bedrohungen sind komplex, und wenn Angreifer in Graphen denken, müssen Verteidiger das auch tun. Dies ist ein Proof of...

CVE-2026-7572 Velociraptor EVTX Parser — Process Crash via Crafted .evtx File

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

CVE-2026-7572 Velociraptor EVTX Parser — Process Crash via Crafted .evtx File

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

Grafiki - Threat Hunting Tool About Sysmon And Graphs

Grafiki is a Django project about Sysmon and graphs, for the time being. In my opinion EventViewer, Elastic and even Kibana, are not graphic enough. The current threats are complicated and if attackers think in graphs, defenders also must do it. This is a proof of concept, the code was not debugg...