22340 matches found
SCOPE
SCOPE: Security Cloud Ops Purple Engagement SCOPE runs AWS purple-team workflows with deterministic Python inventory and bounded AI agents. It audits AWS resources, validates attack paths, generates review-only exploit playbooks, produces controls, and guides Splunk investigations. How It Works R...
evtx
EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...
sysmon-modular
sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...
crowdstrike-falcon-queries
crowdstrike-falcon-queries A collection of Splunk's Search Processing Language SPL for Threat Hunting with CrowdStrike Falcon Developed and maintained by Intelligent Response team, i-secure co., Ltd. crowdstrike-falcon-queries Execution of Renamed Executables List of Living Off The Land Binaries...
attack_range
Splunk Attack Range v5 The Splunk Attack Range builds instrumented cloud environments AWS, Azure, GCP, simulates attacks, and forwards data into Splunk for detection development and testing. What it does: Build labs — Deploy a small, production-like lab Splunk, Windows/Linux servers, optional Kal...
pwnspoof
pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...
CVE-2024-36991
CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-36991 with Asychronous Performance. Installation git clone https://github.com/th3gokul/CVE-2024-36991.git...
Security-Detections-MCP
Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...
whids
IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...
CVE-2026-20253
CVE-2026-20253 Lab Environment Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar Service | ---|--- CVE| CVE-2026-20253 CVSS| 9.8 Critical Type| Unauthenticated Remote Code Execution CWE| CWE-306: Missing Authentication for Critical Function Product| Splunk Enterprise 10.0.x / 10.2.x DISCLAIME...
rip_raw
Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...
CVE-2024-36991
CVE-2024-36991 Nuclei Template Description This repository contains a Nuclei template to detect the path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. The vulnerability allows unauthorized access to sensitive files, such as /etc/passwd. CVE Detai...
Splunk Enterprise - Local File Inclusion
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows. id: CVE-2024-36991 info: name: Splunk...
Splunk Enterprise Patroni REST API - Missing Authentication RCE
Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API PostgreSQL sidecar on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archivecommand and POST /restart to trigger it, achieving remote code...
log4shell-exploitation-detection
Log4Shell CVE-2021-44228 Exploitation, Detection & Remediation A hands-on offensive and defensive security project simulating the full lifecycle of the Log4Shell vulnerability: exploitation from an attacker-controlled VM, detection engineering in Splunk, and validated remediation. Why This Projec...
msticpy
MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...
CVE-2024-36991
CVE-2024-36991 POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file. Overview This is a bulk scanning and exploitation tool for CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. This vulnerability was...
ThreatHunting
ThreatHunting | A Splunk app mapped to MITRE ATT&CK to guide your threat hunts This is a Splunk application containing several dashboards and over 130 reports that will facilitate initial hunting indicators to investigate. You obviously need to be ingesting Sysmon data into Splunk, a good...
printnightmare-detection-lab
PrintNightmare Threat Detection & Incident Response Lab CVE-2021-34527 📌 Overview This project documents an end-to-end security monitoring, detection engineering, and incident response implementation targeting PrintNightmare CVE-2021-34527. PrintNightmare is a critical vulnerability in the Window...