Spip-Go

Spip - Network Honeypot Sensor Spip is a lightweight, low-interaction network honeypot sensor. It listens for arbitrary incoming TCP traffic plain and TLS, captures what scanners and bots send, and logs each connection as structured JSON ECS-shaped for easy ingestion into your SIEM or data lake...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

cicd-sensor

This repository does not have a README...

snare

SNARE Super Next generation Advanced Reactive honEypot About SNARE is a web application honeypot sensor attracting all sort of maliciousness from the Internet. Documentation The documentation can be found here. Basic Concepts Surface first. Focus on the attack surface generation. Sensors and...

maltrail

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

CVE-2023-22631

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2023-22631

CVE-2023-22631 affects PRTG Network Monitor versions before 23.1.82 , allowing a remote attacker with high privileges to write to files via the HTTP XML/REST Sensor , resulting in a low integrity impact (CVSS 3.1: 2.7 LOW , AV:N/AC:L/PR:H). The Dutch NCSC advisory notes that an authenticated mali...

CVE-2023-22632

PRTG Network Monitor (Paessler) before version 23.1.82 is affected by a vulnerability that allows remote attackers to write to files via the FTP Server Count Sensor . The attack requires high privileges (authenticated access) over the network, resulting in a low integrity impact (CVSS 3.1 score 2...

tsusen

Tsusen 津波センサー 是一款独立的网络传感器，用于日常从外部（即互联网）的常规流量中收集信息（例如大规模扫描、服务扫描等）。任何异常都值得密切关注，因为它们可以作为即将发生事件的良好预测基础。例如，针对新发现的 Web 服务漏洞（如 Heartbleed）的利用，应在受影响的网络端口上产生可见的“尖峰”入侵者总数。 以下命令集可让您的 Tsusen 传感器快速启动并运行（开箱即用，默认设置，监控接口为 any，HTTP 报告接口使用默认端口 8339）： root@kitploit: sudo apt-get install python-pcapy sudo pip instal...

tsusen

Tsusen 津波センサー is a standalone network sensor made for gathering information from the regular traffic coming from the outside i.e. Internet on a daily basis e.g. mass-scans, service-scanners, etc.. Any disturbances should be closely watched for as those can become a good prediction base of...

fibratus

Fibratus 用于实时威胁检测和防护的安全传感器 快速开始 » 文档 • 规则 • Filaments • 下载 • 讨论 Fibratus 通过审视和断言广泛的系统事件，并将其与行为驱动的规则引擎和 YARA 内存扫描器进行比对，从而检测并根除高级攻击者攻击手法、恶意软件和新兴威胁。 事件可以被路由到各种各样的输出接收器，或写入捕获文件，以供本地检查和取证分析。借助 filaments，你可以用自己的工具扩展 Fibratus，并利用 Python 生态系统的全部力量。 简而言之，Fibratus 的信条建立在三大支柱之上：实时行为检测 、内存扫描 和取证分析 。 让 Fibrat...

KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \\sms,...

maltrail

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

corelight-client

.. corelight-client: .. Version number is filled in automatically. .. |version| replace:: 1.5.17 ==================================== Cliente de línea de comandos de Corelight Sensor .. contents:: Resumen Esta herramienta proporciona un cliente de línea de comandos para el Sensor Corelight , un...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Introducción Este es un fork y una actualización significativa de la publicación inicial en el sitio web de ISC Storm Center por Scott Jensen como un documento BACS y los scripts publicados en Github. https://github.com/fkadriver/Dshield-ELK...

CVE-2007-3830

CVE-2007-3830 IBM Proventia Sensor Appliance - 多个输入验证漏洞 Exploit-db 发布页：https://www.exploit-db.com/exploits/30290/ Exploit-db 论文：https://www.exploit-db.com/docs/english/13081-having-fun-with-proventia-gx5108-&-gx5008-insecurities.pdf Git...

msnm-sensor

Description MSNM-S Multivariate Statistical Network Monitoring-Sensor shows the practical suitability of the approaches found in PCA-MSNM and in Hierarchical PCA-MSNM works. The first one present the MSNM approach and new multivariate statistical methodology for network anomaly detection while th...

msnm-sensor

描述 MSNM-S （多变量统计网络监控传感器）展示了 PCA-MSNM 和 层次化 PCA-MSNM 工作中方法的实际适用性。前者提出了 MSNM 方法和用于网络异常检测的新多变量统计方法论，而后者则将前一种方法应用于层次化结构化的网络系统中。这些工作的主要思想是利用多变量统计技术，以两种统计量的形式生成有用信息。这种轻量信息从网络层次的低层传递到高层。这样，根传感器（例如边界路由器）接收所有统计信息，从而能够计算自己的统计量（Q、D）。通过检查这些统计量，安全分析师可以确定是否发生异常事件，即某些统计值超过特定控制限时。 详情请参阅...

CorelightForSecOps

Recopilar registros del Sensor de Corelight Este documento describe cómo puede recopilar registros del Sensor de Corelight mediante la configuración del Sensor de Corelight y un forwarder de Chronicle. Este documento también enumera los tipos de registro admitidos y las versiones de Corelight...

snare

SNARE 超级下一代高级响应式蜜罐 关于 SNARE 是一个 Web 应用蜜罐传感器，可吸引来自互联网的各种恶意行为。 文档 文档可在此处找到。 基本概念 表面优先。专注于攻击面生成。 传感器与主控。轻量级收集器（SNARE）与中央决策器（tanner）。 开始使用 你需要 Python 3.6 来运行 SNARE 本工具已在最新的基于 Ubuntu 的 Linux 上测试通过。 设置步骤 1. 获取 SNARE：git clone https://github.com/mushorg/snare.git 并 cd snare 2. 可选 创建虚拟环境：python3 -m venv...