ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

guardd

Guardd Détection comportementale des anomalies pour Linux, propulsée par eBPF et l'apprentissage automatique. Guardd apprend le comportement normal d'un hôte Linux et signale les activités qui s'écartent de cette référence. Les capteurs du noyau collectent les exécutions de processus et les...

batea

Batea Une batea est une grande poêle peu profonde en bois ou en fer traditionnellement utilisée par les chercheurs d'or pour laver le sable et le gravier afin de récupérer des pépites d'or. Batea est un framework de classement d'appareils réseau basé sur le contexte, utilisant la famille...

AI-driven-MITRE-Attack

POC : обнаружение техник MITRE ATT&CK и обогащение оповещений с помощью ИИ Этот репозиторий демонстрирует конвейер машинного обучения для обнаружения техник MITRE ATT&CK по логам и обогащения результатов с помощью локальной LLM. Обзор Проект состоит из двух основных компонентов : 1. Модель...

CVE-2020-0665

CVE-2020-0665 - Обход фильтрации SID Доказательство концепции для CVE-2020-0665, которая позволяет обходить фильтрацию SID в лесах Active Directory межлесная атака. Требования к атаке Целевой контроллер домена не должен быть обновлён после февраля 2020 года. Необходимо предварительно...

SysTrace

SysTrace 2.0 ptrace-based Linux syscall monitor and sandbox for analyzing ELF binaries. SysTrace runs a target inside an isolated Linux namespace environment, traces its system calls and child processes, applies rule-based detection and weighted risk scoring, then uses a Random Forest classifier ...

Log4Shell-vulnerability-CVE-2021-44228-

Обнаружение угроз Log4Shell CVE-2021-44228 Обзор Этот репозиторий предоставляет углубленный анализ и реализацию системы обнаружения угроз Log4Shell CVE-2021-44228 на основе машинного обучения. Он включает: Понимание Log4Shell : что это такое и чем опасно Сбор набора данных : источники и шаги...

ThreatDetect

ThreatDetect ThreatDetect is a Streamlit-based insider threat detection prototype that analyzes employee activity data and flags potentially risky behavior. It uses a trained XGBoost classifier together with an Isolation Forest anomaly detector to produce organisation-level risk summaries and...

ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection

The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on officia...

"Warning: Exchange account was not found"

Challenge When backing up Exchange Online mailboxes, Veeam Backup for Microsoft 365 intermittently fails to discover and process some mailboxes, reporting the following warning: Warning: Exchange account was not found The affected mailboxes vary between job runs, and in some cases, only a small...

Categorical Robustness Assessment for Machine Learning Based Network Intrusion Detection Systems

Network Intrusion Detection Systems NIDS heavily utlize Machine Learning ML but ML models can be manipulated via adversarial attacks. These attacks add carefully crafted perturbations to network traffic data that leads to misclassifications. While prior work has demonstrated adversarial...

Meta-Quantum Ensemble Framework for Robust Network Intrusion Detection

Intrusion Detection Systems IDSs must maintain high detection sensitivity while operating under strict false-positive constraints, a challenge intensified by class imbalance and heterogeneous IoT traffic. This work investigates whether heterogeneous quantum learners can provide useful and...

Botnet Detection on CTU-13 Using Lightweight Machine Learning Models

Botnets are among the most persistent cyber threats, enabling large-scale attacks such as spam, credential theft, and distributed denial-of-service DDoS. While deep learning approaches have recently been applied to botnet detection, they are computationally intensive and often lack...

Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach

The Invisible Internet Project I2P provides strong anonymity through garlic routing and distributed network architecture, making it attractive for legitimate privacy needs. Nevertheless, the same properties can be exploited by malicious actors to steal sensitive information from corporate network...

A Comparative Analysis of Machine Learning Models for Intrusion Detection in Intelligent Transport Systems

AI-powered edge computing security is moving Intelligent Transportation Systems ITS from passive, rule-based protections to proactive, smart, zero-touch, self-sufficient safeguards that neutralize threats in milliseconds. As transportation becomes more connected with edge computing, massive IoT,...

SeqShield: A Behavioral Analysis Approach to Uncover Rootkits

Rootkits are among the most elusive types of malware, capable of bypassing traditional static analysis methods due to their metamorphic behavior. Signature-based detection techniques struggle against these threats, necessitating a shift toward dynamic analysis approaches. We propose SeqShield, a...

Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

Microsoft Threat Intelligence reveals how Russian hacking group Forest Blizzard uses home routers for DNS hijacking and spying...

Russia Hacked Routers to Steal Microsoft Office Tokens

Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens...

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

In this article 1. DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activity 2. Mitigation and protection guidance 3. Microsoft Defender detection and hunting guidance Executive summary Forest Blizzard, a threat actor linked to the Russian military, has been...

AegisUI: Behavioral Anomaly Detection for Structured User Interface Protocols in AI Agent Systems

AI agents that build user interfaces on the fly assembling buttons, forms, and data displays from structured protocol payloads are becoming common in production systems. The trouble is that a payload can pass every schema check and still trick a user: a button might say "View invoice" while its...