76 matches found
DFIR-O365RC
目录 1. 模块描述 2. 安装和先决条件 1. 使用 Docker 2. 手动安装 3. 管理 DFIR-O365RC 应用程序 1. 创建应用程序 2. 更新应用程序 3. 移除应用程序 4. 权限和许可证要求 5. 模块包含的函数 6. 生成的文件 DFIR-O365RC 在 SSTIC 2021（信息技术与通信安全研讨会）上进行了展示。演示文稿的幻灯片和录制视频（法文）可在此处获取：链接。 ⚠️ 2024年3月31日，Microsoft 弃用了 我们用于 DFIR-O365RC 的身份验证方法。因此，我们于2024年8月发布了 2.0.0 版本，其中包含关于身份验证的重大变更...
grove
Grove 是一个软件即服务（SaaS）日志收集框架，旨在支持从本身不支持日志流式传输的服务中收集日志。 Grove 使团队能够以可靠且一致的方式从其供应商处收集安全相关事件。然后，这些数据可以使用团队现有的工具进行存储和分析，以支持威胁检测和合规计划。 开箱即用，Grove 提供： 🪵 可靠且周期性的日志收集。 ☁️ 支持大量广泛使用的 SaaS 应用程序和服务。 🧱 基于插件的“连接器”，以支持新的应用程序和服务。 🧳 “自带”缓存、输出、配置和机密后端。 Grove 由 HashiCorp 安全团队创建并持续维护。 请注意 ：虽然这不是一个官方的 HashiCorp...
DShield-SIEM
DShield Sensor Log Collection with Elasticsearch Introducción Este es un fork y una actualización significativa de la publicación inicial en el sitio web de ISC Storm Center por Scott Jensen como un documento BACS y los scripts publicados en Github. https://github.com/fkadriver/Dshield-ELK...
CorelightForSecOps
Recopilar registros del Sensor de Corelight Este documento describe cómo puede recopilar registros del Sensor de Corelight mediante la configuración del Sensor de Corelight y un forwarder de Chronicle. Este documento también enumera los tipos de registro admitidos y las versiones de Corelight...
Phant0m
Phant0m | Windows 事件日志杀手 Svchost 在所谓的共享服务进程中至关重要，多个服务可以共享一个进程以减少资源消耗。将多个服务分组到单个进程中可以节省计算资源，这一考虑对 NT 设计者来说尤其重要，因为创建 Windows 进程比其他操作系统（例如 Unix 系列）需要更多时间和内存。1 简而言之：在 Windows 操作系统中，svchost.exe 管理服务，服务实际上作为线程在 svchost.exe 下运行。Phant0m 针对事件日志服务，找到负责事件日志服务的进程，检测并终止负责事件日志服务的线程。因此，虽然事件日志服务在系统中看似仍在运行（因为...
HTSOC
HTSOC — Integrated SOC System for Event Monitoring, Detection, and Investigation HTSOC is a self-built Security Operations Center system in a lab environment. The system combines log collection, detection with Splunk, alert/case management with TheHive, Observable analysis with Cortex, IOC lookup...
EUVD-2026-53474
A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...
PT-2026-60460
Name of the Vulnerable Software and Affected Versions ubuntu-pro-client affected versions not specified Description An insecure symlink following issue exists within the pro collect-logs command framework. The utility uses predictable temporary file paths or user-accessible log directories to...
CVE-2026-10847
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...
EUVD-2026-36247
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...
CVE-2026-10847
CVE-2026-10847 is a local privilege escalation affecting Check Point Identity Agent Full for Windows OS. An authenticated local user may gain SYSTEM privileges by exploiting improper handling of executable resolution during log collection. The documented impact is elevated privileges on the affec...
CVE-2026-10847 Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...
CVE-2026-10847 Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...
PT-2026-48661
Name of the Vulnerable Software and Affected Versions Check Point Identity Agent Full for Windows OS affected versions not specified Description A local privilege escalation issue exists where an authenticated local user can execute arbitrary code with SYSTEM privileges. This occurs due to improp...
NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation
Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This...
How to Change Where Logs are Stored on the Veeam Appliances
Changing Log Location Will Break Automated Log Collection The automated log collection tools built into both the Veeam Backup & Replication Web UI of the Veeam Software Appliance and the "Create support bundle" function within the Host Management Console collect logs only from the default log...
MiracleLinux 3 : sos-1.7-9.62.0.1.AXS3 (AXSA:2012-526:01)
The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-526:01 advisory. Sos is a set of tools that gathers information about system hardware and configuration. The information can then be used for diagnostic purposes and debugging...
Release Information for Veeam Backup for Microsoft 365 8.2 and Cumulative Patches
More Recent Version Available Please find the latest version of Veeam Backup for Microsoft 365 here: Veeam Downloads - Latest Version Build Numbers and Versions of Veeam Backup for Microsoft 365 Requirements This release can be used to: update manually from a previous Veeam Backup for Microsoft 3...
How to Collect Logs from Veeam Appliance Installer
Purpose This article documents how to collect logs from the installer for the Software Appliances included with Veeam Backup & Replication 13 Veeam Software Appliance, Veeam Infrastructure Appliance, and Veeam Hardened Repository Appliance. This procedure may be required if an installation-relate...