z9

z9 PowerShell Log Analyzer Japanese Abstract This tools detects the artifact of the PowerShell based malware from the eventlog of PowerShell logging. Online Demo Install git clone https://github.com/Sh1n0g1/z9 cd z9 pip install -r requirements.txt How to use usage: z9.py -h --output OUTPUT -s...

log-add-http-post-bodies

Add POST body excerpt to the HTTP log This script gives analysts the ability to peek into what is being sent in HTTP POST bodies. It provides this by simply extending the HTTP log. Installation :: zkg refresh zkg install corelight/log-add-http-post-bodies Usage The HTTP log will have a new field...

macos-UnifiedLogs

macos-unifiedlogs A simple Rust library that can help parse the macOS Unified Log files. Unified Logs were introduced in macOS version 10.12 Sierra, 2016. Part of Apple's goal to create a unified log format for all Apple products. They exist on macOS, iOS, watchOS, tvOS. The Unified Logs replace...

DEFCON-KQL-KUNG-FU-22

DEFCON-KQL-KUNG-FU-22 My DEFCON30 Cloud Village KQL Kung Fu Workshop slide deck lives here: DEFCON30-KQL-Kung-Fu.pdf If you'd like to practice your KQL skills, visit this Log Analytics Workspace that's maintained with tons of log data by Microsoft: aka.ms/lademo...

CitrixNetscalerAnalysis

Citrix Analysis Notebook A jupyter notebook to aid in automating some of the forensic analysis related to Citrix Netscaler hosts compromised via CVE-2019-19781. For help retrieving artifacts to examine see this Citrix triage script. All notes/suggestions are welcome. Feel free to submit pull...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

MasterParser

MasterParser v2.5 Stop wasting time, let MasterParser do the work! Created & Maintained by: Eilay Yosfan What is MasterParser ? MasterParser stands as a robust Digital Forensics and Incident Response tool meticulously crafted for the analysis of Linux logs within the var/log directory. Specifical...

Sentinel-Queries

KQL for Microsoft Sentinel Some tips, tricks and examples for using KQL for Microsoft Sentinel. 1. Introduction 2. The Anatomy of a KQL Query 3. The Basics 1. Time Basics 2. Where Basics 3. Project Basics 4. Summarize Basics 5. Render Basics 6. Parse and Split Basics Introduction Kusto Query...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

Panoptic

Panoptic Panoptic is an open source penetration testing tool that automates the search and retrieval of common log and config files through path traversal vulnerabilities. Features Async concurrent scanning with configurable worker pool --concurrency Automatic discovery of common log and...

guasap-whatsapp-foresincs-tool

Guasap Forensic The Guasap Forensic implemented in Python under the GNU General Public License, for the extraction and analysis of files, data bases and logs for forensic WhatsApp. What it does? 1. Check root in device 2. Extract DB and multimedia files no root 3. Extract and analyze deleted...

waf-fu

waf-fu AWS WAF v2 log browser and replayer with an interactive TUI. Pulls logs from CloudWatch, S3, and the WAF sampling API with SQLite caching, displays them in a split-pane terminal UI with auth detection and YAML-based filtering, and replays requests through Firefox, Chrome, or curl with full...

CVE-2021-21978

CVE-2021-21978 Exploit script with echo back, a simpler way 0. Vulnerability Information The VMware View Planner Web management interface has an entry for uploading log functionality files, which requires no authentication and the log file path written is user-controllable. By overwriting the...

frida-ios-hook

Frida iOS hook 📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform. 👉 For Android platform: frida-android-hook 👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api Env OS...

CVE-2020-2978

CVE-2020-2978 CVE-2020-2978 refrence link for PoC: https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

ImpossibleTravelLogAnalysis

Impossible Travel Log Analysis by NCC Group About Basic log analysis tool to detect impossible travel via IP address geographic information Expected Data Format A CSV file with the following headers When,User,Event,IP With the following format 2019-04-09...

CVE-2023-21839-metasploit-scanner

CVE-2023-21839-metasploit-scanner Usage git clone https://github.com/kurehalin/CVE-2023-21839-metasploit-scanner cd CVE-2023-21839-metasploit-scanner mkdir -p /.msf4/modules/auxiliary/scanner/http cp weblogiciioprce.py /.msf4/modules/auxiliary/scanner/http chmod +x...

Crassus

Crassus Windows privilege escalation discovery tool Quick start 1. In Process Monitor, select the Enable Boot Logging option. 2. Reboot. 3. Once you have logged in and Windows has settled, run Process Monitor once again. 4. When prompted, save the boot log, e.g., to raw.PML. 5. Reset the default...