Corelight-Ansible-Roles

Corelight-Ansible-Roles Caution: Before you run this version, if you are upgrading, some variable names and locations have changed To get started, simply run this command: source curl https://raw.githubusercontent.com/corelight/Corelight-Ansible-Roles/main/download-run-me-first.sh This product...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Introduction This is fork and a significant update from the initial publication on the ISC Storm Center website by Scott Jensen as a BACS paper and the scripts published in Github. https://github.com/fkadriver/Dshield-ELK...

corelight-client

.. corelight-client: .. Version number is filled in automatically. .. |version| replace:: 1.5.17 ==================================== Corelight Sensor Command Line Client .. contents:: Overview This tool provides a command-line client for the Corelight Sensor , aBro appliance engineered from the...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

Spip-Go

Spip - Network Honeypot Sensor Spip is a lightweight, low-interaction network honeypot sensor. It listens for arbitrary incoming TCP traffic plain and TLS, captures what scanners and bots send, and logs each connection as structured JSON ECS-shaped for easy ingestion into your SIEM or data lake...

maltrail

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

tsusen

Tsusen 津波センサー is a standalone network sensor made for gathering information from the regular traffic coming from the outside i.e. Internet on a daily basis e.g. mass-scans, service-scanners, etc.. Any disturbances should be closely watched for as those can become a good prediction base of...

CorelightForSecOps

Collect Corelight Sensor logs This document describes how you can collect Corelight Sensor logs by configuring the Corelight Sensor and a Chronicle forwarder. This document also lists the supported log types and supported Corelight versions. For more information, see Data ingestion to Chronicle...

CVE-2022-0997

Fidelis Network and Deception - CVE-2022-0997 - Insecure File Permissions Privilege Escalation Releasability and Acknowledgements The exploit was approved for public release by the United States Government. Special thanks to the servicemen and government liaisons tasked with approving the...

snare

SNARE Super pot de miel réactif avancé de nouvelle génération À propos SNARE est un capteur honeypot d'application web attirant toutes sortes de malveillances depuis Internet. Documentation La documentation peut être trouvée ici. Concepts de base Surface d'abord. Concentrez-vous sur la génération...

snare

SNARE Super Next generation Advanced Reactive honEypot About SNARE is a web application honeypot sensor attracting all sort of maliciousness from the Internet. Documentation The documentation can be found here. Basic Concepts Surface first. Focus on the attack surface generation. Sensors and...

msnm-sensor

Description MSNM-S Multivariate Statistical Network Monitoring-Sensor shows the practical suitability of the approaches found in PCA-MSNM and in Hierarchical PCA-MSNM works. The first one present the MSNM approach and new multivariate statistical methodology for network anomaly detection while th...

msnm-sensor

Description MSNM-S Multivariate Statistical Network Monitoring-Sensor démontre la pertinence pratique des approches présentées dans les travaux PCA-MSNM et Hierarchical PCA-MSNM. La première présente l'approche MSNM et une nouvelle méthodologie statistique multivariée pour la détection d'anomalie...

maltrail

Maltrail Maltrail est un système de détection de trafic réseau qui identifie les communications avec une infrastructure malveillante connue et signale certaines anomalies de trafic sélectionnées. Il met en correspondance les domaines, les URL, les adresses IP, les paires IP:port et les valeurs...

fibratus

Fibratus Capteur de sécurité pour la détection des menaces et la protection en temps réel Commencer » Documentation • Règles • Filaments • Téléchargement • Discussions Fibratus détecte et éradique les techniques avancées des attaquants, les logiciels malveillants et les menaces émergentes en...

KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \\sms,...

plague

plague Default Detections for EDR The detections detailed below are what I attempt to establish on any EDR product I deploy or work on. Take your own considerations for criticality and datasets. Check out this post for how you can work on achieving detections...

memhunter

Memhunter Chasse automatisée des malwares résidents en mémoire à grande échelle Ce projet est EN COURS DE DÉVELOPPEMENT. Attendez-vous à des changements de fonctionnalités et des versions binaires dans les semaines à venir. Aperçu Memhunter est un outil capteur de points de terminaison spécialisé...

tsusen

Tsusen 津波センサー — это автономный сетевой сенсор, предназначенный для сбора информации из обычного трафика, поступающего извне т.е. из Интернета на ежедневной основе например, массовые сканирования, сканирования сервисов и т.д.. Любые аномалии следует внимательно отслеживать, так как они могут стать...

VirtualLockSensorLPE

VirtualLockSensorLPE Description Local privilege escalation PoC exploit for CVE-2025-0886 that targets Elliptic Virtual Lock Sensor version 3.1.60531.2 running on Windows, which is installed by default on certain Lenovo laptop models. Allows execution of a payload in the context of SYSTEM from a...