PiFinger

root@kitploit: | \ | | | | | | | | .--. .--./ .---. .--. | / | | | | .-. | / /';/ /\ /'\ | | | | | | | | | | | | \ .//| ., | | || || ||.', '..' --- 仅供娱乐与安全 @octosec --- --- W:besimaltinok.com | T:altnokbesim --- --- G:besimaltnok --- --------------------------------------------------- 关于项目...

maltrail

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts 用于检测CVE-2019-12255、CVE-2019-12256、CVE-2019-12258和CVE-2019-12260的Suricata LUA脚本 CVE-2019-12255 该脚本检测CVE-2019-12255，被检查的数据包需要设置了PSH、ACK和URG标志，并且有效载荷大小超过1500字节。然后检查紧急指针的值是否设置为0，这会在易受攻击的设备上导致整数下溢。...

zeek-spicy-ipsec

IPSec Este es un analizador de protocolos Zeek que detecta VPN IPSec basado en Spicy. Debes instalar Spicy para usar este paquete. Un blog que detalla el desarrollo de este analizador: https://zeek.org/2021/04/20/zeeks-ipsec-protocol-analyzer/ RFCs: https://tools.ietf.org/html/rfc2406 ESP...

cve-2021-1675-printnightmare

简单策略以检测CVE-2021-1675 脚本提供的以下功能 :: 此Zeek包利用pcap及以下工作的成果：https://github.com/LaresLLC/CVE-2021-1675.git root@kitploit: 基于以下事实 安装 root@kitploit: zeek-pkg install zeek/initconf/ 或 @load 详细说明： 详细告警与描述：脚本会生成以下告警： 启发式检测逻辑很简单：检查 1. namedpipe中的\pipe\spoolss 2. endpoint中的spoolss 3...

zeek-strrat-detector

Un detector de malware STRRAT basado en Zeek Este es un detector de malware STRRAT basado en Zeek Spicy. PCAP https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/ Salida de ejemplo root@kitploit: % zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector % cat...

zeek-gozi-detector

Detector de malware Gozi Este paquete de Zeek detecta actividad del malware bancario Gozi. Recursos: Los archivos RAR que busca este paquete se analizaron en los siguientes artículos: https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/...

Network-Detection-Engine

version: 0.001 网络检测引擎 root@kitploit: 一款轻量级的“网络入侵检测引擎”，可捕获实时流量并实时检测真实世界的实时攻击。（Zig0.15.2）。 特性 root@kitploit: - 使用libpcap进行实时数据包捕获 - 自定义数据包解析： - 以太网 - IPv4 - TCP / UDP / ICMP - 攻击检测： - SYN洪水检测 - ICMP洪水检测 - TCP/UDP端口扫描检测 - 死亡之Ping（Ping of Death） - 基于特征的检测： - SQL注入（UNION, DROP, 1=1） - 跨站脚本（XSS） - 命令注入...

Surviving the Mythos Era: Richard Bejtlich on the Case for NDR

Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What evidence do we have? How do we know we’re seeing it all, in context? Answering these questions requires teams to go...

The Alert Firehose Finally Meets Its Match

Ask a cybersecurity pro about Network Detection and Response NDR and you might still hear "Noisy," "Too much data." But ask the teams running NDR that includes agentic AI capabilities and you'll hear they're actually using it to catch threats earlier, triage faster, and chase fewer false positive...

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense By Maulik Maheta and Chao Sun · April 14, 2026 Executive summary A DCSync attack is one of the most formidable techniques an adversary can deploy after gaining a foothold in an Active Directory AD environmen...

Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception

Unmasking impostors is something the art world has faced for decades, and there are valuable lessons from the works of Elmyr de Hory that can apply to the world of defensive cybersecurity. During the 1960s, de Hory gained infamy as a premier forger, passing off counterfeit masterworks of Picasso,...

My Day Getting My Hands Dirty with an NDR System

My objective As someone relatively inexperienced with network threat hunting, I wanted to get some hands-on experience using a network detection and response NDR system. My goal was to understand how NDR is used in hunting and incident response, and how it fits into the daily workflow of a Securi...

When SPNs Go Rogue: Detection and Remediation with Trellix NDR

When SPNs Go Rogue: Detection and Remediation with Trellix NDR By Maulik Maheta and Henry Bernabe · February 10, 2026 Executive summary Service Principal Names SPNs are essential for Kerberos authentication in Active Directory AD, but misconfigurations, such as assigning SPNs to standard user...

The Fake Domain Controller You Didn’t See Coming: Detecting DCShadow Attacks Using Trellix NDR

The Fake Domain Controller You Didn’t See Coming: Detecting DCShadow Attacks Using Trellix NDR By Maulik Maheta and Chao Sun · December 17, 2025 Executive summary DCShadow is a covert post-exploitation technique that enables an attacker to impersonate a domain controller and make unauthorized,...

Silent Domain Hijack: Detecting DCSync with Trellix NDR

Silent Domain Hijack: Uncovering the DCSync Attack and Detecting with Trellix NDR By Maulik Maheta and Chao Sun · December 10, 2025 Executive summary DCSync is one of the most powerful and stealthy techniques an attacker can use once they have gained access to an Active Directory AD environment...

ThreatBook Peer-Recognized as a Strong Performer in the 2025 Gartner® Peer Insights™ Voice of the Customer for Network Detection and Response — for the Third Consecutive Year

Singapore, Singapore, 13th November 2025, CyberNewsWire...

The Silent Threat in Active Directory: How AS-REP Roasting Steals Passwords Without a Trace and Trellix NDR’s Rapid Detection

The Silent Threat in Active Directory: How AS-REP Roasting Steals Passwords Without a Trace and Trellix NDR’s Rapid Detection By Maulik Maheta · October 15, 2025 Executive summary Adversaries use AS-REP Roasting to extract and crack password hashes from Active Directory AD accounts with Kerberos...

Can Your Security Stack See ChatGPT? Why Network Visibility Matters

Generative AI platforms like ChatGPT, Gemini, Copilot, and Claude are increasingly common in organizations. While these solutions improve efficiency across tasks, they also present new data leak prevention for generative AI challenges. Sensitive information may be shared through chat prompts, fil...

Exposing PathWiper: DCOM Abuse and Network Erasure

Exposing PathWiper: A Deep Dive into DCOM Abuse and Network Erasure With Trellix NDR By Maulik Maheta and Lishoy Mathew · August 12, 2025 Executive summary Ukraine’s national energy and telecommunications infrastructure was the primary targets of the PathWiper attack in 2025. The attack was...