CVE-2021-44228

CVE-2021-44228 This repository contains altered community scripts related to CVE-2021-44228 ported to EDR environments. The scripts were modified to be compatible with other technologies' additional requirements. See the linked repositories for an up-to-date and original version of the modified...

RITA-J

RITA Real Intelligence Threat Analytics в Jupyter Notebook RITA — это фреймворк с открытым исходным кодом для анализа сетевого трафика, спонсируемый Active Countermeasures RITA-J — это реализация функций RITA в Jupyter Notebook. Цель — поддержка всех типов журналов Firewall/Proxy/DNS в форматах...

JndiLookup

JndiLookup Инструмент для анализа уязвимости Apache Log4j 2 CVE-2021-44228 Этот инструмент использует функцию "lookup" из log4j-2 для тестирования уязвимости JNDI. Цель — легко запускать функцию lookup например, для нормализации логов или реального тестирования на какой-либо полезной нагрузке —...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

DumpsterDiver

DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...

grapl

Grapl Grapl is a graph-based SIEM platform built by-and-for incident response engineers. NOTICE Grapl has ceased operations as a company. As such, this code is no longer being actively developed, but will remain available in an archived state. Details Grapl leverages graph data structures at its...

check-your-pulse

check-your-pulse Cet utilitaire peut aider à déterminer si des indicateurs de compromission IOCs existent dans les fichiers journaux d'un appareil Pulse Secure VPN pour CVE-2019-11510. La Cybersecurity and Infrastructure Security Agency CISA a observé de nombreuses organ isations compromises malg...

ImpossibleTravelLogAnalysis

Анализ невозможных перемещений Impossible Travel Log Analysis от NCC Group О программе Простой инструмент анализа журналов для обнаружения невозможных перемещений с использованием географической информации по IP-адресам Ожидаемый формат данных CSV-файл со следующими заголовками When,User,Event,IP...

nginx-rift-detector

Детектор NGINX Rift для CVE-2026-42945 Только для чтения Bash-проверка для скомпрометированных серверов NGINX. Помогает оператору ответить на два вопроса после раскрытия CVE-2026-42945: Продолжает ли этот сервер работать с уязвимой сборкой NGINX или опасной конфигурацией rewrite? Показывают ли...

CVE-2024-3400-Checker

Проверка уязвимости Palo - CVE-2024-3400 Обзор Этот скрипт предназначен для проверки признаков компрометации в системах Palo, в частности для уязвимости, обозначенной как CVE-2024-3400. Он ищет в файлах архивов пакетов техподдержки gz или .tgz конкретные записи журналов, которые могут указывать н...

apache-web-log-analysis-lab

Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...

wazuh v4.10.5

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

wazuh v5.0.0-beta5

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

PT-2026-79950

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

Allocation of Resources Without Limits or Throttling

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the validation capability of the Observability log analysis feature. An...

CVE-2026-72667

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

UBUNTU-CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...