rustinel

Rustinel 오픈소스 엔드포인트 탐지. 세 가지 플랫폼. 당신의 규칙. 네이티브 Windows, Linux, macOS 텔레메트리에서 Sigma, YARA, IOC 탐지를 실행합니다. Rust로 작성되었으며, 로컬 알림을 제공하고 클라우드 계정이 필요하지 않습니다. 탐지 콘텐츠를 가져오고, 엔드포인트를 모니터링하며, 이미 사용 중인 도구로 알림을 전송하세요. 다운로드 | 문서 | 탐지 팩 | 웹사이트 Rustinel을 사용하는 이유 엔드포인트 탐지는 여러분이 실행하는 플랫폼과 이미 이해하고 있는 규칙에서 작동해야 합니다...

FalconHound

FalconHound ПРИМЕЧАНИЕ: Начиная с релиза BloodHound CE 7.0, база данных по умолчанию была заменена на Postgres. Эта версия FalconHound по-прежнему использует Neo4j в качестве базы данных по умолчанию. Если вы хотите продолжать использовать FalconHound вместе с последней версией BloodHound, добавь...

Incident-Response-Powershell

PowerShell Цифровая криминалистика и реагирование на инциденты Этот репозиторий содержит скрипты для реагирования на инциденты на основе PowerShell. Скрипт DFIR Скрипт DFIR-Script.ps1 собирает криминалистические артефакты на устройствах Windows. Ключевые возможности: Сбор более 25 потенциальных...

ARTLAS

ARTLAS — система анализа логов Apache в реальном времени Анализатор логов Apache в реальном времени, основанный на топ-10 уязвимостях OWASP, выявляет попытки эксплуатации вашего веб-приложения и уведомляет вас или вашу команду реагирования через Telegram, Zabbix и Syslog/SIEM. ARTLAS использует...

malwarescanner

MalwareScanner Очень простой сканер вредоносных программ на основе сравнения хэшей Иногда это может понадобиться при реагировании на инциденты. Если вы обнаружили новые или подозрительные файлы во время реагирования, вам может понадобиться проверить, где эти файлы находятся в системах. Тогда вам...

Open-Source-Threat-Intel-Feeds

무료 위협 인텔/IOC 피드 이 저장소에는 추가 요구 사항 없이 사용할 수 있는 오픈 소스 무료 위협 인텔 피드가 포함되어 있습니다. CSV ThreatIntelFeeds는 공급업체, 설명, 카테고리 및 URL을 기준으로 구조화된 방식으로 저장됩니다. 위협 인텔 피드를 제공하는 공급업체는 아래에 설명되어 있습니다. 다음과 같은 피드 카테고리를 사용할 수 있습니다: SSL IP DNS URL MD5 SHA1 SHA256 CVEID JA3 NamePipes 콘텐츠는 있는 그대로 제공됩니다. 비즈니스 환경에서 콘텐츠를 사용할 때는 ...

LDAPMon

LDAPMon LDAPMon — это POC-сборщик телеметрии для ETW-провайдера Microsoft-Windows-LDAP-Client. После запуска журналы сохраняются в средстве просмотра событий. В состав этого POC входит парсер Sentinel, чтобы при необходимости вы могли собирать эти данные в SIEM. Лучше всего использовать рядом с...

Exploit for Improper Handling of Length Parameter Inconsistency in Mongodb

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Sc...

PCI DSS 4.0 FIM Requirements Simplified with Qualys File Integrity Monitoring

File Integrity Monitoring FIM is one of the essential requirements under PCI DSS 4.0. It helps organizations detect and respond to unauthorized changes in critical system files, configuration files, or content files, which is crucial for maintaining the security of cardholder data. Organizations...

Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!

Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the...

The importance of combined user and data behavior analysis in anomaly detection

Muqeet Khan, Head of Sales Engineering Australia and New Zealand For decades security teams have understood the importance of tracking user behavior to identify potential cybersecurity threats. Behavior analysis systems first appeared in the early 2000s, and in 2015 Gartner officially defined Use...

Automating Agent-less Vulnerability Assessment for Intune Enrolled Mobile Devices

Most Mobile Device Management solutions lack critical functionality such as vulnerability assessment and patch management. Integration with a popular MDM like Microsoft Intune allows Qualys to provide automated onboarding and continuous scanning of your mobile devices, among other functions to...

Add Security Events to Your Monitoring Tools

Real-time monitoring is important in every organization because it enables stakeholders to understand what is happening at any given time and react quickly. There are a lot of systems and devices we can and should monitor using tools such as application performance monitoring, digital performance...

Why You Need Cloud-Based Security for Agile, Innovative and Lean IT

Digital transformation isn't just a buzzworthy trend or a finite phase for today's businesses. Rolling adaptation to an ever-changing environment and continuous digital evolution has become the new normal for enterprises -- the key to success in this agile, demanding, and hyper-connected age. To...

Excerpts From: Do More with Less—How Endpoint Security in the Cloud is Helping Companies Stay Secure

If you're responsible for security at your company, you know that you're held back by things like limited budgets, a lack of skilled personnel, and too many security products complicating your stack. In Carbon Black’s recent webinar, we discussed how endpoint security in the cloud can simplify yo...

Partner Perspectives: Extend Visibility Without Expanding Your Team

The best partnerships seem destined from the start - Han Solo and Chewbacca, Mario and Luigi - even newer partners, like Groot and Rocket. The best partners combine their strengths to expand the opportunities available to them. This is true of partnerships in cybersecurity stay with us here. Bett...

Make Application Access IT-Friendly

More and more companies are looking at alternatives to VPNs due to the security risks associated with network level access. And increasingly, the goal is to eliminate network trust through a zero trust architecture - which is one of the primary reasons many of these organizations are deploying...

Maximize security insights by integrating threat intelligence data from Akamai with your SIEM

Since 2005, when Gartner coined the term, SIEM Security Information and Event Management solutions have grown in importance for the security industry. SIEM solutions provide a centralized view to easily access and analyze security information from multiple sources, and then prioritize mitigation...

Superior and safe user experiences with the Akamai Cloud Delivery Platform

Your customers are unique and they all expect fast, secure, personalized digital experiences. They are spread across the world, in regions of varying network connectivity, utilize a plethora of devices and screen sizes - making it challenging to deliver your experiences. By delivering 95 Exabytes...

Dropbox: CSV Injection with the CVS export feature

The report mentions a well known problem with any CSV export function. If the exported data has an Excel formula, the user will be warned and if the user clicks through a warning they might get some code execution. At the same time, fixing this bug means that the CSV data is no longer correct and...