tarian

Tarian 通过预先注册受信任的进程和受信任的文件签名，保护运行在 Kubernetes 上的应用程序免受恶意攻击。Tarian 会检测未知进程和对已注册文件的更改，然后发送告警并采取自动化操作。保护您的 K8s 环境免受勒索软件侵害！ 我们希望将此项目作为开源项目维护，以对抗针对我们最喜爱的 Kubernetes 生态系统的攻击。通过持续贡献，我们可以作为社区共同应对威胁。 Tarian 是如何工作的？ Tarian 集群代理运行在 Kubernetes 集群中，检测未知进程和对文件的未知更改，将其报告给 Tarian 服务器，并可选择采取操作：删除违规的 Pod。它使用 eBPF...

Cohab_Processes

CohabProcesses 这个Aggressor脚本旨在帮助内部红队识别在其环境中运行的异常或外来进程（"共居"）。 红队可以整理一份"已知"进程列表（可以独立完成，也可与蓝队合作），并将其提供给该Aggressor脚本。这份进程列表可能包括那些在"我们的网络中被观察到至少x次"的进程，以便建立基线。一旦脚本加载到CobaltStrike中，beacon输出将会针对以下命令进行修改/颜色编码： 1. shell tasklist 2. ps 3. TrustedSec 的 tasklist BOF（你不必使用此BOF，但强烈推荐）...

EDRHunt

EDRHunt EDRHunt scans Windows services, drivers, processes, registry, wmi for installed EDRs Endpoint Detection And Response. Read more about EDRHunt here. Install Binary Download the latest release from the release section. Releases are built for windows/amd64. Go Requires Go to be installed on...

cnitch

cnitch cnitch（snitch 或 container snitch）是一个简单的框架和命令行工具，用于监控 Docker 容器以识别任何以 root 身份运行的进程。 为什么这是一件坏事？如果您还没有访问过 can I haz non-privileged containers? by mhausenblas，那么我建议您现在就去那里获取所有信息。 在开发 cnitch 时，我遇到了一个我认为是应用程序错误的问题：cnitch 报告自身在 Docker 容器中是一个 root 进程。我不确定为什么会这样，因为 Dockerfile 明确声明我正在创建一个不以 root...

ppid-spoofing

Detección de la suplantación de PID padre https://www.countercept.com/blog/detecting-parent-pid-spoofing/...

JShielder - Automates The Process Of Installing All The Necessary Packages To Host A Web Application And Hardening A Linux Server

JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application or services. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server wi...

Malicious Process Detection: Authenticode Not Verified

Binary data wmimalwareauthenticodeinvalidsignedinfo.nbin...

Malicious Process Detection: Authenticode Not Signed

Binary data wmimalwareauthenticodenotsigned.nbin...

Malicious Process Detection: Authenticode With Invalid Signature

Binary data wmimalwareauthenticodeinvalidsigned.nbin...

Malicious Process Detection: User Defined Malware Running (Linux)

Binary data linuxusermd5s.nbin...

Beurk - Experimental Unix Rootkit

BEURK is an userland preload rootkit for GNU/Linux, heavily focused around anti-debugging and anti-detection. NOTE: BEURK is a recursive acronym for B EURK E xperimental U nix R oot K it Features Hide attacker files and directories Realtime log cleanup on utmp/wtmp Anti process and login detectio...

Nessus本地权限提升漏洞

Nessus是一款流行的系统漏洞扫描与分析软件。 Nessus恶意进程检测插件存在安全漏洞，由于该插件会创建一个以SYSTEM运行的服务程序，并且低权限用户可允许修改该程序，允许攻击者利用漏洞创建恶意程序并执行，提升权限。 0 Nessus appliance engine 5.2.1 目前没有详细解决方案提供： http://www.nessus.org/...

NCC00643 Technical Advisory: Nessus Authenticated Scan Local Privilege Escalation

...................................... Vulnerability Summary ...................................... Title Nessus Authenticated Scan - Local Privilege Escalation Release Date 20 March 2014 Reference NGS00643 Discoverer Neil Jones Vendor Tenable Vendor Reference RWZ-21387-181 Systems Affected Nessu...

Malicious Process Detection: Malware Signed By Stolen Bit9 Certificate

Binary data wmibit9running.nbin...

Malicious Process Detection: APT1 Software Running

Binary data wmiapt1running.nbin...

File Locking Local Denial of Service; Impact on sendmail

-----BEGIN PGP SIGNED MESSAGE----- File Locking Local Denial of Service Impact on sendmail Reported by lumpy [email protected] Introduction ============ Any application which uses either flock or fcntl style locking or other APIs that use one of these locking methods such as open with OEXLOCK and...