Detect-It-Easy

Detect It Easy DiE 是一款强大的文件类型识别工具，深受全球恶意软件分析师 、网络安全专家 和逆向工程师 的青睐。同时支持基于签名 和启发式分析 ，DiE 能够在广泛的平台上实现高效的文件检测，包括 Windows、Linux 和 MacOS 。其灵活且基于脚本的检测架构使其成为该领域最通用的工具之一，并附有全面的支持操作系统镜像列表。 🚀 快速开始 💎 下载发布版/测试版 🧪 DiE API 库（面向开发者） 📋 更新日志 💬 参与翻译 💡 为什么选择 Detect It Easy？ Detect It Easy 的灵活签名系统 和脚本能力 使其成为恶意软件分析 和数字...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

dynmx

dynmx 原型 dynmx （读作 dynamics ）是一种基于签名的检测方法，用于基于Windows API调用序列的行为恶意软件特征。简而言之，你可以将 dynmx 视为用于API调用跟踪（所谓的函数日志）的YARA，这些跟踪来自恶意软件沙箱。因此，检测方法的数据基础不是静态分析的恶意软件样本本身，而是在恶意软件沙箱中对恶意软件样本进行动态分析期间生成的数据。目前， dynmx 支持以下恶意软件沙箱的函数日志： VMRay（函数日志，文本和XML格式） CAPEv2（report.json文件） Cuckoo（report.json文件） 该检测方法在硕士论文《基于Windows...

Revoke-Obfuscation

Revoke-Obfuscation v1.0 介绍 Revoke-Obfuscation 是一个 PowerShell v3.0+ 兼容的 PowerShell 混淆检测框架。 作者 Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes 研究 博客文章：https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html...

Network-Detection-Engine

version: 0.001 Motor de Detección de Red root@kitploit: Un 'Motor de Detección de Intrusiones de Red' ligero que captura Tráfico en Vivo y detecta ataques reales en tiempo real Zig0.15.2. Características root@kitploit: - Captura de paquetes en vivo usando libpcap - Análisis personalizado de...

Advance_WAF_project_CS

WAFinity - Infinite Protection, Intelligent Detection WAFin...

Hybrid IDS Using Signature-Based and Anomaly-Based Detection

Intrusion detection systems IDS are essential for protecting computer systems and networks against a wide range of cyber threats that continue to evolve over time. IDS are commonly categorized into two main types, each with its own strengths and limitations, such as difficulty in detecting...

Authentication Bypass

OpenStack Keystone is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of AWS Signature-based requests in token endpoints, which allows an attacker to gain unauthorized Keystone access using crafted requests...

Network Intrusion Detection: Evolution from Conventional Approaches to LLM Collaboration and Emerging Risks

This survey systematizes the evolution of network intrusion detection systems NIDS, from conventional methods such as signature-based and neural network NN-based approaches to recent integrations with large language models LLMs. It clearly and concisely summarizes the current status, strengths, a...

EUVD-2020-12789

Malware in sbrugna...

Demystifying the Role of Rule-Based Detection in AI Systems for Windows Malware Detection

Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples,...

Hybrid LLM-Enhanced Intrusion Detection for Zero-Day Threats in IoT Networks

This paper presents a novel approach to intrusion detection by integrating traditional signature-based methods with the contextual understanding capabilities of the GPT-2 Large Language Model LLM. As cyber threats become increasingly sophisticated, particularly in distributed, heterogeneous, and...

Intelligent ARP Spoofing Detection Using Multi-Layered Machine Learning (ML) Techniques for IoT Networks

Address Resolution Protocol ARP spoofing remains a critical threat to IoT networks, enabling attackers to intercept, modify, or disrupt data transmission by exploiting ARP's lack of authentication. The decentralized and resource-constrained nature of IoT environments amplifies this vulnerability,...

CVE-2010-5170

Race condition in Online Solutions Security Suite 1.5.14905.0 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes...

Stealing or reusing votes

Lines of code Vulnerability details Impact It is possible to reuse/steal user's votes if they are supposed to cast vote by signature. Proof of Concept Casting votes during nominee election and member election is possible by calling the functions: castVoteWithReasonAndParams...

The Battle Against Business Logic Attacks: Why Traditional Security Tools Fall Short

As the digital landscape continues to evolve, so do the tactics utilized by bad actors that are seeking to exploit application vulnerabilities. Among the most insidious types of attacks are business logic attacks BLAs. Unlike known attacks, which can be identified by signatures or patterns, such ...

Real-Time Defense of Multi-Cloud Environments From Malicious Attacks and Threats

Organizations today cannot detect real-time threats at runtime due to the multi-cloud infrastructure, resulting in the possibility of malicious actors exploiting the environment. It is imperative for the modern organization to have a solution to detect advanced run-time threats in real-time to...

Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable

A new malware campaign has been discovered targeting cryptocurrency, non-fungible token NFT, and DeFi aficionados through Discord channels to deploy a crypter named "Babadeda" that's capable of bypassing antivirus solutions and stage a variety of attacks. "This malware installer has been used in ...

AntiVirus Evasion Techniques

Introduction Antivirus software looks for, detects, and eliminates viruses as well as other harmful software such as worms, trojans, adware, and others. Such programs are intended to be used as a preventative measure in cyber security, preventing threats from entering your computer and causing...

[SECURITY] Fedora 35 Update: testdisk-7.1-7.fc35

Tool to check and undelete partition. Works with FAT12, FAT16, FAT32, NTFS, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS. PhotoRec is a signature based file recovery utility. It handles more than 440 file formats including JPG,...