9 matches found
kraken
Kraken은 Windows, Mac, FreeBSD 및 Linux용으로 빌드할 수 있는 간단한 크로스 플랫폼 Yara 스캐너입니다. 주로 사고 대응, 연구 및 임시 탐지엔드포인트 보호용이 아님를 목적으로 합니다. 핵심 기능은 다음과 같습니다: 제공된 Yara 규칙으로 실행 중인 실행 파일 및 프로세스 메모리 스캔go-yara 활용 자동 실행을 위해 설치된 실행 파일 스캔go-autoruns 활용 제공된 Yara 규칙으로 파일 시스템 스캔 Django 기반 웹 인터페이스가 있는 원격 서버로 감지 결과 보고 지속적으로 실행되며...
BeaconEye
BeaconEye Introduction BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity. How it works BeaconEye will scan live processes or MiniDump files for suspected CobaltStrike beacons. In li...
pesieve-go
pesieve-go Golang bindings for PE-sieve. Requires pe-sieve32.dll, pe-sieve64.dll of a supported version to be present in the project directory, or in a path pointed by the environment variable: PESIEVEDIR. API Exposes the following wrappers for PE-sieve API: PESieveVersion uint32 func PESieveHelp...
memgrep
Memory grep 複数のプロセスにわたるメモリ検索ユーティリティ NCC Group Plc がオープンソースとしてリリース - http://www.nccgroup.com/ 開発者: Ollie Whitehouse、ollie dot whitehouse at nccgroup dot com https://github.com/nccgroup/memgrep AGPL のもとで公開されています。詳細は LICENSE を参照してください プラットフォーム: Microsoft Windows 機能 各プロセスを開く 有効なメモリページを特定する 文字列の ASCII...
CloudZ RAT potentially steals OTP messages using Pheno plugin
Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool RAT and a previously undocumented plugin called "Pheno." According to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that mirrors the TeamPCP LiteLLM technique. What the postinstall payload does: - Harvests environment variables matching 40+ patterns AWS, GCP, Azure, GitHub, OpenAI, Stripe, etc. - Reads SSH keys, .npmrc,...
CDK
This is an open-sourced container penetration toolkit called CDK, designed for offering stable exploitation in different slimmed containers without any OS dependency. It comes with useful net-tools and many powerful PoCs/EXPs to help escape container and takeover K8s cluster easily. The toolkit i...
Microsoft Windows Defender AV: Turn on process scanning whenever real-time protection is enabled
This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavprocessscanningrealtimeprotection.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Turn on process scanning whenever real-time protection is enabled Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...
