Detect-It-Easy

Detect It Easy（DiE）は、マルウェアアナリスト 、サイバーセキュリティ専門家 、リバースエンジニア に広く使われている強力なファイルタイプ識別ツールです。シグネチャベース とヒューリスティック分析の両方をサポートし、Windows、Linux、MacOS を含む幅広いプラットフォームで効率的なファイル検査を可能にします。適応性の高いスクリプト駆動型検出アーキテクチャにより、この分野で最も多用途なツールの一つとなっており、対応OSイメージの包括的なリストを備えています。 🚀 はじめに 💎 リリース/ベータ版をダウンロード 🧪 DiE API ライブラリ（開発者向け） 📋...

Revoke-Obfuscation

Revoke-Obfuscation v1.0 はじめに Revoke-Obfuscationは、PowerShell v3.0以上に対応したPowerShell難読化検出フレームワークです。 著者 Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes 研究 ブログ記事：https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

dynmx

dynmx プロトタイプ dynmx （ダイナミクスと発音）は、Windows API呼び出しシーケンスに基づいた、行動的なマルウェア特徴のシグネチャベース検出アプローチです。簡略化して言えば、 dynmx は、マルウェアサンドボックスから得られるAPI呼び出しトレース（いわゆるファンクションログ）に対する一種のYARAと考えることができます。したがって、この検出アプローチのデータ基盤は、静的に解析されるマルウェアサンプル自体ではなく、マルウェアサンドボックス内での動的解析中に生成されるデータです。現在、 dynmx は以下のマルウェアサンドボックスのファンクションログをサポートしていま...

Network-Detection-Engine

version: 0.001 网络检测引擎 root@kitploit: 一款轻量级的“网络入侵检测引擎”，可捕获实时流量并实时检测真实世界的实时攻击。（Zig0.15.2）。 特性 root@kitploit: - 使用libpcap进行实时数据包捕获 - 自定义数据包解析： - 以太网 - IPv4 - TCP / UDP / ICMP - 攻击检测： - SYN洪水检测 - ICMP洪水检测 - TCP/UDP端口扫描检测 - 死亡之Ping（Ping of Death） - 基于特征的检测： - SQL注入（UNION, DROP, 1=1） - 跨站脚本（XSS） - 命令注入...

Advance_WAF_project_CS

WAFinity - Infinite Protection, Intelligent Detection WAFin...

Hybrid IDS Using Signature-Based and Anomaly-Based Detection

Intrusion detection systems IDS are essential for protecting computer systems and networks against a wide range of cyber threats that continue to evolve over time. IDS are commonly categorized into two main types, each with its own strengths and limitations, such as difficulty in detecting...

Authentication Bypass

OpenStack Keystone is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of AWS Signature-based requests in token endpoints, which allows an attacker to gain unauthorized Keystone access using crafted requests...

Network Intrusion Detection: Evolution from Conventional Approaches to LLM Collaboration and Emerging Risks

This survey systematizes the evolution of network intrusion detection systems NIDS, from conventional methods such as signature-based and neural network NN-based approaches to recent integrations with large language models LLMs. It clearly and concisely summarizes the current status, strengths, a...

EUVD-2020-12789

Malware in sbrugna...

Demystifying the Role of Rule-Based Detection in AI Systems for Windows Malware Detection

Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples,...

Hybrid LLM-Enhanced Intrusion Detection for Zero-Day Threats in IoT Networks

This paper presents a novel approach to intrusion detection by integrating traditional signature-based methods with the contextual understanding capabilities of the GPT-2 Large Language Model LLM. As cyber threats become increasingly sophisticated, particularly in distributed, heterogeneous, and...

Intelligent ARP Spoofing Detection Using Multi-Layered Machine Learning (ML) Techniques for IoT Networks

Address Resolution Protocol ARP spoofing remains a critical threat to IoT networks, enabling attackers to intercept, modify, or disrupt data transmission by exploiting ARP's lack of authentication. The decentralized and resource-constrained nature of IoT environments amplifies this vulnerability,...

CVE-2010-5170

Race condition in Online Solutions Security Suite 1.5.14905.0 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes...

Stealing or reusing votes

Lines of code Vulnerability details Impact It is possible to reuse/steal user's votes if they are supposed to cast vote by signature. Proof of Concept Casting votes during nominee election and member election is possible by calling the functions: castVoteWithReasonAndParams...

The Battle Against Business Logic Attacks: Why Traditional Security Tools Fall Short

As the digital landscape continues to evolve, so do the tactics utilized by bad actors that are seeking to exploit application vulnerabilities. Among the most insidious types of attacks are business logic attacks BLAs. Unlike known attacks, which can be identified by signatures or patterns, such ...

Real-Time Defense of Multi-Cloud Environments From Malicious Attacks and Threats

Organizations today cannot detect real-time threats at runtime due to the multi-cloud infrastructure, resulting in the possibility of malicious actors exploiting the environment. It is imperative for the modern organization to have a solution to detect advanced run-time threats in real-time to...

Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable

A new malware campaign has been discovered targeting cryptocurrency, non-fungible token NFT, and DeFi aficionados through Discord channels to deploy a crypter named "Babadeda" that's capable of bypassing antivirus solutions and stage a variety of attacks. "This malware installer has been used in ...

AntiVirus Evasion Techniques

Introduction Antivirus software looks for, detects, and eliminates viruses as well as other harmful software such as worms, trojans, adware, and others. Such programs are intended to be used as a preventative measure in cyber security, preventing threats from entering your computer and causing...

[SECURITY] Fedora 35 Update: testdisk-7.1-7.fc35

Tool to check and undelete partition. Works with FAT12, FAT16, FAT32, NTFS, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS. PhotoRec is a signature based file recovery utility. It handles more than 440 file formats including JPG,...