Incident-Response-Powershell

Powershell Digital Forensics & Incident Response This repository provides PowerShell-based Incident Response scripts. DFIR Script The DFIR-Script.ps1 script collects forensic artifacts on Windows devices. Key features include: Collecting over 25 potential indicators of compromise. CSV-based expor...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

ARTLAS

ARTLAS Apache Real Time Logs Analyzer System Real time Apache log analyzer, based on top 10 OWASP vulnerabilities, identifies attempts of exploration in your web application, and notify you or your incident team on Telegram, Zabbix and Syslog/SIEM. ARTLAS uses the regular expression from the...

FalconHound

FalconHound NOTE: As of the BloodHound CE 7.0 release, the default database has been switched to Postgres. This version of FalconHound still relies on Neo4j to be the default database. If you want to keep using FalconHound while running the latest BloodHound version, add the following line to you...

Open-Source-Threat-Intel-Feeds

Free Threat Intel/IOC Feeds This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds a...

malwarescanner

MalwareScanner Escáner de malware muy básico por comparación de hash A veces puede ser necesario durante una respuesta a incidentes. Si encuentras archivos nuevos o sospechosos durante la respuesta, querrás verificar dónde existen esos archivos en los sistemas. Por lo tanto, es posible que...

LDAPMon

LDAPMon LDAPMon is a POC telemetry collector for the Microsoft-Windows-LDAP-Client ETW Provider. Once started logs will be stored within the EventViewer. This POC comes with a Sentinel parser so that if you want to collect this data within a SIEM you may do so. Used best when ran next to Sysmon...

Security Bulletin: IBM QRadar SIEM interation for Microsoft Azure Event Hub contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM integration with Microsoft Azure Event Hub Vulnerability Details CVEID:CVE-2026-66257 DESCRIPTION: A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion...

rustinel v1.3.0

Rustinel Open-source endpoint detection for Windows, Linux, and macOS. Native telemetry to Sigma, YARA, IOC detection, and SIEM-ready alerts. Written in Rust. Website | Docs | Download | SIEM demos Quick Start Rustinel ships release archives with a binary, default config, demo rules, and a logs/...

Exploit for Improper Handling of Length Parameter Inconsistency in Mongodb

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Sc...

PCI DSS 4.0 FIM Requirements Simplified with Qualys File Integrity Monitoring

File Integrity Monitoring FIM is one of the essential requirements under PCI DSS 4.0. It helps organizations detect and respond to unauthorized changes in critical system files, configuration files, or content files, which is crucial for maintaining the security of cardholder data. Organizations...

Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!

Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the...

The importance of combined user and data behavior analysis in anomaly detection

Muqeet Khan, Head of Sales Engineering Australia and New Zealand For decades security teams have understood the importance of tracking user behavior to identify potential cybersecurity threats. Behavior analysis systems first appeared in the early 2000s, and in 2015 Gartner officially defined Use...

Automating Agent-less Vulnerability Assessment for Intune Enrolled Mobile Devices

Most Mobile Device Management solutions lack critical functionality such as vulnerability assessment and patch management. Integration with a popular MDM like Microsoft Intune allows Qualys to provide automated onboarding and continuous scanning of your mobile devices, among other functions to...

Add Security Events to Your Monitoring Tools

Real-time monitoring is important in every organization because it enables stakeholders to understand what is happening at any given time and react quickly. There are a lot of systems and devices we can and should monitor using tools such as application performance monitoring, digital performance...

Why You Need Cloud-Based Security for Agile, Innovative and Lean IT

Digital transformation isn't just a buzzworthy trend or a finite phase for today's businesses. Rolling adaptation to an ever-changing environment and continuous digital evolution has become the new normal for enterprises -- the key to success in this agile, demanding, and hyper-connected age. To...

Excerpts From: Do More with Less—How Endpoint Security in the Cloud is Helping Companies Stay Secure

If you're responsible for security at your company, you know that you're held back by things like limited budgets, a lack of skilled personnel, and too many security products complicating your stack. In Carbon Black’s recent webinar, we discussed how endpoint security in the cloud can simplify yo...

Partner Perspectives: Extend Visibility Without Expanding Your Team

The best partnerships seem destined from the start - Han Solo and Chewbacca, Mario and Luigi - even newer partners, like Groot and Rocket. The best partners combine their strengths to expand the opportunities available to them. This is true of partnerships in cybersecurity stay with us here. Bett...

Make Application Access IT-Friendly

More and more companies are looking at alternatives to VPNs due to the security risks associated with network level access. And increasingly, the goal is to eliminate network trust through a zero trust architecture - which is one of the primary reasons many of these organizations are deploying...

Maximize security insights by integrating threat intelligence data from Akamai with your SIEM

Since 2005, when Gartner coined the term, SIEM Security Information and Event Management solutions have grown in importance for the security industry. SIEM solutions provide a centralized view to easily access and analyze security information from multiple sources, and then prioritize mitigation...