DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

VindicateTool

Vindicate -brightgreen An LLMNR/NBNS/mDNS Spoofing Detection Toolkit for network administrators What is Vindicate? Vindicate is a tool which detects name service spoofing, often used by IT network attackers to steal credentials e.g. Windows Active Directory passwords from users. It's designed to...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

WELA

WELA Windows Event Log Analyzer ゑ羅 A tool for auditing Windows event log settings. Created by Yamato Security — make sure you are actually recording the events that matter for DFIR. 📖 Read the Documentation → Available in 15 languages — English · 日本語 · 繁體中文 · 한국어 · Deutsch · Türkçe · Français ·...

EnableWindowsLogSettings

Yamato Security의 DFIR 및 위협 헌팅을 위한 Windows 이벤트 로그 구성 가이드 English | 日本語 이 문서는 sigma 규칙에 대한 로깅을 중점으로 Windows 이벤트 로그를 올바르게 구성하고 모니터링하는 또 다른 가이드입니다. 이 문서는 작성 중이므로 정기적으로 다시 확인해 주시기 바랍니다. TLDR 기본 Windows 감사 설정에서는 sigma 탐지 규칙의 약 1020%만 사용할 수 있습니다. Windows 로그가 활성화되어 있어도 기본적으로 로그 최대 크기는 120MB이므로 증거가 빠르게 덮어...

hayabusa v4.1.0

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

Uncontrolled Recursion

Overview github.com/google/go-attestation/attest is a Go-Attestation abstracts remote attestation operations across a variety of platforms and TPMs, enabling remote validation of machine identity and state. This project attempts to provide high-level primitives for both client and server logic...

EUVD-2026-74300

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service DoS. The WinEvents.readELAMAggregation function recurses for every nested elamAggregation sub-event without...

PT-2026-88521

Name of the Vulnerable Software and Affected Versions go-attestation versions prior to 0.6.2 Description An uncontrolled recursion issue in the Windows SIPA event log parser allows a remote attacker to cause a denial of service DoS. The readELAMAggregation function in the WinEvents object recurse...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

CVE-2026-33566 is a cypher injection issue in LogonTracer prior to v2.0.0. When specially crafted Windows event log data is loaded, the contents of the database may be altered. The issue is documented across multiple sources (NVD, CVE List, JVN) and is addressed by updating to LogonTracer v2.0.0....

CVE-2026-33566: Improper Neutralization of Special Elements in Data Query Logic

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

Windows Service for User (S4U) Scheduled Task Persistence Event Trigger

This Metasploit module creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires...

EUVD-2011-2753

Malware in sbrugna...

EUVD-2011-0782

Malware in sbrugna...

The vulnerability of the Windows operating system’s event log allows a hacker to trigger a memory buffer overflow and re-write the XML log generated by the task scheduler.

The vulnerability of Windows operating system event logs is related to insufficient checking of values in XML log fields. Exploiting this vulnerability can allow an attacker to cause a memory buffer overflow in the event log and re-write it by sending a specially crafted XML file...

MAL-2025-191933 Malicious code in win32evtlog (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4aba891520e5d5ae607dd5069c1f70512a339cbfeca374b680328cf1e406d3ad Research packages targeting typosquatting and dependency confusions, without really harmful behaviour - just calling home through DNS resolver. Related to...