RpcInvestigator

RPC Investigator 请阅读我们的博客文章公告。 RPC Investigator RPCI 是一个基于 .NET/C 的 Windows Forms 用户界面应用程序，为 Windows RPC 端点提供高级发现和分析接口。该工具围绕 NtApiDotNet 平台现有的核心 RPC 功能提供了可视化界面，包括： 枚举所有活动 ALPC RPC 服务器 从任何 PE 文件中解析 RPC 服务器 从进程及其加载的模块（包括服务）中解析 RPC 服务器 从符号服务器拉取符号信息 将 RPC 服务器定义导出为序列化的 .NET 对象，供您自己的脚本使用 除了这些核心功能，RPCI...

ogi-transforms

OGI转换注册表 面向OGI（一款开源OSINT与链接分析工具）的社区转换集合。 工作原理 transforms/目录下的每个子目录都是一个可独立安装的转换。OGI CLI与转换中心UI通过读取index.json（每次合并时自动生成）来发现可用的转换。 安装转换 使用OGI后端项目中的CLI： root@kitploit: cd backend uv sync uv run ogi transform search shodan uv run ogi transform install shodan-host-lookup 或者使用OGI内部的转换中心UI。 运行时上限覆盖...

seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

ogi-transforms

OGI Transform Registry Community transforms for OGI, an open source OSINT and link analysis tool. How it works Each directory under transforms/ is an independently installable transform. The OGI CLI and Transform Hub UI read index.json auto-generated on each merge to discover what's available...

mig

MIG: Mozilla InvestiGator MIG es la plataforma de Mozilla para la investigación quirúrgica de endpoints remotos. ⚠️ Aviso de desuso ⚠️ Mozilla ya no mantiene el proyecto Mozilla InvestiGator MIG. Mozilla tampoco utiliza este código internamente. Eres bienvenido a usar este código tal cual, sin...

CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

PT-2026-71045

The hunt delete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT CLIENT usually assigned to the "investigator" role instead of the "DELETE RESULTS" permission usually only assigned to "administrators"...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...

My Day Getting My Hands Dirty with an NDR System

My objective As someone relatively inexperienced with network threat hunting, I wanted to get some hands-on experience using a network detection and response NDR system. My goal was to understand how NDR is used in hunting and incident response, and how it fits into the daily workflow of a Securi...

VulnCheck KEV: CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

EUVD-2023-29974

Malicious code in bioql PyPI...

CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

CVE-2025-6264 Velociraptor priviledge escalation via UpdateConfig artifact

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

PT-2025-26266

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The issue concerns the Velociraptor's artifact collection feature, which allows users to collect and execute VQL queries packaged into artifacts from endpoints. These artifacts typically...

CVE-2023-26101

In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability to retrieve files on the Flowmon appliance's local filesystem...

ExxonMobil Lobbyist Caught Hacking Climate Activists

The Department of Justice is investigating a lobbying firm representing ExxonMobil for hacking the phones of climate activists: The hacking was allegedly commissioned by a Washington, D.C., lobbying firm, according to a lawyer representing the U.S. government. The firm, in turn, was allegedly...