nysm

nysm A stealth post-exploitation container. Table of Content 1. Introduction 2. Installation 2.1 Requirements 2.2 Linux headers 2.3 Build 3. Usage 3.1 Examples 4. How it works 4.1 In general 4.2 Hide eBPF objects 4.3 Hide Auditd logs 4.4 Hide PIDs 4.5 Hide sockets 5. Limitations Introduction...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

RedELK

RedELK The Red Team's SIEM - a tool for Red Teams for tracking and alarming about Blue Team activities as well as enhanced usability in long term operations. 1. Enhanced usability and overview for the red team operators by creating a central location where all relevant operational logs from...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

EVTX-ATTACK-SAMPLES

Windows EVTX Samples 200 EVTX examples: This is a container for windows events samples associated to specific attack and post-exploitation techniques. Can be useful for: Testing your detection scripts based on EVTX parsing Training on DFIR and threat hunting using event logs Designing detection u...

APT-Hunter

APT-Hunter Threat hunting for Windows event logs, built with a purple-team mindset. APT-Hunter is a threat hunting tool for Windows event logs. It uses pre-defined detection rules and log statistics to surface APT activity hidden in large volumes of events, cutting the time needed to uncover...

beacon-hunter

Beacon Hunter Detecting Non-Periodic Structured C2 via Additive Recurrence Beacon Hunter detects command-and-control beaconing that uses phi-compatible additive recurrence scheduling — a growing, non-periodic timing pattern where each inter-connection interval approximately equals the sum of the...

NginxHunter

NginxHunter Description NginxHunter is a comprehensive tool designed to analyze Nginx access logs for security vulnerabilities and suspicious activities. It detects SQL injection attempts, scanner tools, sensitive path accesses, exploitation attempts, webshells, and more. Ideal for system...

moodle-cve

Challenge creation Inspiration moodle CVE-2025-26529: posoning admin logs to full admin account takeover @ref: https://www.youtube.com/watch?v=dhVF6hQUzWU @ref: https://github.com/NightBloodz/moodleTestingEnv @ref: https://medium.com/@Nightbloodz/admin-account-takeover-in-moodle-093708a0f749...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

CVE-2026-104706

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104806

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

CVE-2026-104806 Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

EUVD-2026-92293

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

CVE-2026-104806

The Mitel MiVoice Office 400 System is vulnerable to a path traversal flaw in the web management portal (TCP port 443) within the Maintenance → System Logs functionality. Due to insufficient validation of user-supplied file paths, an attacker with high privileges can traverse the directory struct...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...