epagneul

epagneul Epagneul is a tool to visualize and investigate windows event logs. Deployment Requires docker and docker-compose to be installed. Installing root@kitploit: make Offline deployment On a machine connected to internet, build an offline release: root@kitploit: make release This will create ...

EDRaser

EDRaser Usage Guide EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual. Automated Mode In automated mode, EDRaser scans the C class of a given address space of IPs...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

evtx-baseline

evtx-baseline 一个托管示例良性软件（goodware）evtx 日志的仓库，其中包含示例软件安装和基本用户交互 捐赠 win10-client.tgz 由 @phantinuss 捐赠 win11-client.tgz 由 @frack113 捐赠 win7-x86.tgz 由 @pH-T 捐赠 win2022-evtx.tgz 由 @Neo23x0 捐赠 win2022-ad.tgz 由 @frack113 捐赠 win2022-0-20348-azure.tgz 由 @Neo23x0 捐赠 win11-client-2023.tgz 由 @nasbench 捐赠...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Sample EVTX files are in the .\evtx directory Note If your antivirus freaks out after...

APT-Hunter

APT-Hunter APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity . APT-Hunter use pre-defined detection rules and focus on statistics to uncover...

EVTX-ATTACK-SAMPLES

Windows EVTX 样本 200 个 EVTX 示例： 这是一个包含与特定攻击和后渗透技术相关的 Windows 事件样本的容器。 可用于： 测试基于 EVTX 解析的检测脚本 使用事件日志进行 DFIR 和威胁狩猎培训 使用 Windows 和 Sysmon 事件日志设计检测用例 如果你是红队成员，可避免/绕过高噪音技术 注意：映射已细化到 ATT&CK 技术层面（而非具体程序步骤）。 映射到 MITRE 战术的 EVTX 内容详情可查看此处，统计摘要如下： 使用 attack-navigator 查看所覆盖 TTP 的概览： Winlogbeat-Bulk-Read 附带一个...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

CVE-2026-33566

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

PT-2026-35276

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered...

How-to Restore Lost Access to Cache Database After Using Custom SSL Certificate

Article Applicability This article is relevant only if the Veeam ONE deployment uses a custom SSL certificate, and not the one generated by the Veeam ONE installer. The error shown in the challenge section can also occur if the Veeam ONE Caching Service cannot access the PostgreSQL instance that...

CVE-2025-34091

A padding oracle vulnerability exists in Google Chrome’s AppBound cookie encryption mechanism due to observable decryption failure behavior in Windows Event Logs when handling malformed ciphertext in SYSTEM-DPAPI-encrypted blobs. A local attacker can repeatedly send malformed ciphertexts to the...

CVE-2025-34091

Rejected reason: Neither filed by Chrome nor a valid security vulnerability...

CVE-2025-34091

...

PVS Server: Windows Event logging for UEFI target Devices Boot Time inaccurate

The customer had built a new UEFI based vdisk and deployed it to production. The customer subsequently observed that the PVS Servers were recording a clearly inaccurate boot time, of millions of minutes, in Windows Event logs when target devices were booting. Example inaccurate boot time logged i...

SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Vulnerability

Exploit Title: SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Exploit Author: Milad Karimi Ex3ptionaL Contact: email protected Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Vendor Homepage: https://www.kiwisyslog.com/ Softwar...

NoArgs - Tool Designed To Dynamically Spoof And Conceal Process Arguments While Staying Undetected

NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows internals on the go. This allows NoArgs to alter process arguments discreetly. Default Cmd: Windows Event Logs...

IBM QRadar WinCollect Agent Resource Management Error Vulnerability

IBM QRadar WinCollect Agent is an agent program from International Business Machines IBM for collecting and sending Windows event logs. A resource management error vulnerability exists in IBM QRadar WinCollect Agent that stems from vulnerability to server-side request forgery attacks. No detailed...