ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

batea

Batea Una batea è una grande padella poco profonda di legno o ferro utilizzata tradizionalmente dai cercatori d'oro per lavare sabbia e ghiaia e recuperare pepite d'oro. Batea è un framework di ranking di dispositivi di rete basato sul contesto, che utilizza la famiglia di algoritmi di machine...

CVE-2020-0665

CVE-2020-0665 - Bypass del Filtro SID Proof of Concept per CVE-2020-0665, che permette di bypassare il filtraggio SID nelle foreste di Active Directory Attacco Cross Forest. Requisiti per l'attacco La macchina del Domain Controller di destinazione non deve essere stata aggiornata dopo febbraio...

Log4Shell-vulnerability-CVE-2021-44228-

Detecção de Ameaças Log4Shell CVE-2021-44228 Visão Geral Este repositório fornece uma análise aprofundada e a implementação de um Sistema de Detecção de Ameaças Log4Shell CVE-2021-44228 baseado em Aprendizado de Máquina. Inclui: Entendendo o Log4Shell : O que é e por que é perigoso Coleta de...

SysTrace

SysTrace Uma ferramenta de monitoramento de chamadas de sistema Linux e análise comportamental de segurança que combina rastreamento baseado emptrace, isolamento leve de namespaces e classificação por aprendizado de máquina. O SysTrace observa o comportamento em tempo de execução de um...

guardd

guardd Maschinell lernbasierte Verhaltensanomalieerkennung für Linux mit eBPF + Isolation Forest Guardd sammelt systemnahe Ereignisse Prozessausführung, Netzwerkaktivität, aggregiert sie zu zeitfensterbasierten Merkmalsvektoren und erkennt anomales Verhalten mittels eines maschinellen Lernmodells...

ThreatDetect

ThreatDetect ThreatDetect è un prototipo di rilevamento delle minacce interne basato su Streamlit che analizza i dati delle attività dei dipendenti e segnala comportamenti potenzialmente rischiosi. Utilizza un classificatore XGBoost addestrato insieme a un rilevatore di anomalie Isolation Forest...

AI-driven-MITRE-Attack

POC: Rilevamento e Arricchimento degli Alert MITRE Attack basato su AI Questo repository dimostra una pipeline di machine learning per rilevare tecniche MITRE ATT&CK dai log e arricchire l'output utilizzando un LLM locale. Panoramica Il progetto è suddiviso in due componenti principali : 1. Model...

ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection

The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on officia...

Categorical Robustness Assessment for Machine Learning Based Network Intrusion Detection Systems

Network Intrusion Detection Systems NIDS heavily utlize Machine Learning ML but ML models can be manipulated via adversarial attacks. These attacks add carefully crafted perturbations to network traffic data that leads to misclassifications. While prior work has demonstrated adversarial...

Meta-Quantum Ensemble Framework for Robust Network Intrusion Detection

Intrusion Detection Systems IDSs must maintain high detection sensitivity while operating under strict false-positive constraints, a challenge intensified by class imbalance and heterogeneous IoT traffic. This work investigates whether heterogeneous quantum learners can provide useful and...

Botnet Detection on CTU-13 Using Lightweight Machine Learning Models

Botnets are among the most persistent cyber threats, enabling large-scale attacks such as spam, credential theft, and distributed denial-of-service DDoS. While deep learning approaches have recently been applied to botnet detection, they are computationally intensive and often lack...

Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach

The Invisible Internet Project I2P provides strong anonymity through garlic routing and distributed network architecture, making it attractive for legitimate privacy needs. Nevertheless, the same properties can be exploited by malicious actors to steal sensitive information from corporate network...

A Comparative Analysis of Machine Learning Models for Intrusion Detection in Intelligent Transport Systems

AI-powered edge computing security is moving Intelligent Transportation Systems ITS from passive, rule-based protections to proactive, smart, zero-touch, self-sufficient safeguards that neutralize threats in milliseconds. As transportation becomes more connected with edge computing, massive IoT,...

SeqShield: A Behavioral Analysis Approach to Uncover Rootkits

Rootkits are among the most elusive types of malware, capable of bypassing traditional static analysis methods due to their metamorphic behavior. Signature-based detection techniques struggle against these threats, necessitating a shift toward dynamic analysis approaches. We propose SeqShield, a...

Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

Microsoft Threat Intelligence reveals how Russian hacking group Forest Blizzard uses home routers for DNS hijacking and spying...

Russia Hacked Routers to Steal Microsoft Office Tokens

Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens...

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

In this article 1. DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activity 2. Mitigation and protection guidance 3. Microsoft Defender detection and hunting guidance Executive summary Forest Blizzard, a threat actor linked to the Russian military, has been...

AegisUI: Behavioral Anomaly Detection for Structured User Interface Protocols in AI Agent Systems

AI agents that build user interfaces on the fly assembling buttons, forms, and data displays from structured protocol payloads are becoming common in production systems. The trouble is that a payload can pass every schema check and still trick a user: a button might say "View invoice" while its...

CVE-2026-2947

A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java of the component User Profile Handler. The manipulation results in cross site scripting. The attack can be executed...