224 matches found
commando-vm
¿Qué es CommandoVM? Complete Mandiant Offensive VM "CommandoVM" es una distribución de seguridad integral y personalizable basada en Windows para pruebas de penetración y red teaming. CommandoVM incluye una variedad de herramientas ofensivas no incluidas en Kali Linux que destacan la eficacia de...
flare-fakenet-ng
root@kitploit: | /\ | |/ / | \ | | | | | \ | |/ | | | / \ | ' /| | | | | | | || | | | | / /\ \ | | | | . | | | || . | | | | | | / | . | || |\ | | | | | |\ | || | ||// \|\|| || || || || D O C U M E N T A T I O N FakeNet-NG 3.5 es una herramienta de análisis de red dinámico de próxima...
dncil
dncil is a Common Intermediate Language CIL disassembly library written in Python that supports parsing the header, instructions, and exception handlers of .NET managed methods. Parsed data is exposed through an object-oriented API to help you quickly develop CIL analysis tools using dncil. Why...
capa
Sitio web | Descargar | Interfaz web capa detecta capacidades en archivos ejecutables. Lo ejecutas contra un PE, ELF, módulo .NET, shellcode o un sandbox report y te dice lo que cree que el programa puede hacer. Por ejemplo, puede sugerir que el archivo es un backdoor, es capaz de instalar...
ioc-scanner-CVE-2019-19781
Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...
Vulnerability-Disclosures
Mandiant Vulnerability Disclosures This repository details vulnerabilities disclosed by Mandiant. These vulnerabilities were discovered by internal research, through Red Team assessments, or in use in the wild. Proof of concepts PoCs may or may not be provided. The following licenses/licensing...
stringsifter
StringSifter is a machine learning tool that automatically ranks strings based on their relevance for malware analysis. Quick Links Technical Blogpost - Learning to Rank Strings Output for Speedier Malware Analysis Announcement Blogpost - Open Sourcing StringSifter DerbyCon Talk - StringSifter:...
speakeasy
Speakeasy Speakeasy es un framework de emulación de malware para Windows que ejecuta binarios, controladores y shellcode en un runtime de Windows modelado en lugar de una máquina virtual completa. Emula APIs, el comportamiento de procesos/hilos, el sistema de archivos, el registro y la actividad ...
nightHawkResponse
nightHawk Response Custom built application for asynchronus forensic data presentation on an Elasticsearch backend. This application is designed to ingest a Mandiant Redline "collections" file and give flexibility in search/stack and tagging. The application was born out of the inability to contr...
Ghidrathon
Ghidrathon Ghidrathon is a Ghidra extension that adds Python 3 scripting capabilities to Ghidra. Why? Ghidra natively supports scripting in Java and Jython. Unfortunately, many open-source analysis tools, like capa, Unicorn Engine, angr, etc., are written in Python 3 making it difficult, and in...
Mandiant-Azure-AD-Investigator
Mandiant Azure AD Investigator Centrado en las TTP de UNC2452 Resumen Este repositorio contiene un módulo de PowerShell para detectar artefactos que pueden ser indicadores de actividad de UNC2452 y otros actores de amenazas. Algunos indicadores son indicadores de compromiso de "alta fidelidad",...
heyserial
HEY SERIAL! Autor: Alyssa Rahman @ramen0x3f Creado: 2021-10-27 Última actualización: 2021-12-02 Blog: https://www.mandiant.com/resources/hunting-deserialization-exploits Para más detalles sobre esta herramienta y el proceso de investigación detrás de ella, consulta nuestro blog. Descripción Crea...
ThreatPursuit-VM
root@kitploit: / || | / | \ | | \ / \ \ \ | | | Y | | \ / / | | || || || \ || |/ | \ | | \ / | | | \ \ | | | | /| | \ | | | || | | /|/ || / |/|||| || / MANDIANT THREAT INTELLIGENCE VM Versión 2020.1 [email protected] root@kitploit: Creado por: Dan Kennedy Jake Barteaux @day1player...
citrix-ioc-scanner-cve-2023-3519
CVE-2023-3519 用侵害指標スキャナー このリポジトリには、CVE-2023-3519 に関連する Citrix ADC アプライアンスの侵害を検出するためのユーティリティが含まれています。 このユーティリティとそのリソースは、Mandiant の調査中に収集された侵害指標をエンコードしています。 詳細については、このツールのリリースを発表したブログ記事 をご覧ください。 要約すると、このユーティリティは以下を行います。 既存の侵害を特定するためのベストエフォート型の処理を実行します。 以下のことは行いません 。 侵害を常に 100% 特定することはできません。...
ioc-scanner-CVE-2019-19781
CVE-2019-19781 の侵害指標スキャナ このリポジトリには、CVE-2019-19781に関連するCitrix ADCアプライアンスの侵害を検出するためのユーティリティが含まれています。 このユーティリティとそのリソースは、FireEye Mandiantの調査中に収集された侵害指標をエンコードしています。 詳細については、このツールのリリースを発表したブログをご覧ください。 要約すると、このユーティリティは次のことを行います： 既存の侵害を特定するために最善を尽くします。 次のことは しません ： 100%の確率で侵害を特定すること、または...
Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment
CVE-2025-31324 Zero-Day SAP Vulnerability & Compromise Assessment Tool Joint Release by Onapsis & Mandiant Onapsis and Mandiant have collaborated to release an open-source tool to assist SAP customers in identifying potential compromise related to CVE-2025-31324 and CVE-2025-42999 , a critical...
Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials
Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to "certain" internal Vercel systems. The incident stemmed from the compromise of Context.ai, a third-party artificial intelligence AI tool, that was used by an employee at the...
Mandiant Global Median Dwell Time Deteriorates from 11 to 14 Days
Oh snap. My single most important cybersecurity metric deteriorated again. In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14...
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
SonicWall has formally implicated state-sponsored threat actors as behind the September security breach that led to the unauthorized exposure of firewall configuration backup files. "The malicious activity – carried out by a state-sponsored threat actor – was isolated to the unauthorized access o...
