SysmonSimulator

SysmonSimulator SysmonSimulator는 C 언어로 작성된 오픈 소스 Windows 이벤트 시뮬레이션 유틸리티로, WINAPI를 사용하여 대부분의 공격을 시뮬레이션하는 데 사용할 수 있습니다. 블루 팀이 EDR 탐지 및 상관 관계 규칙을 테스트하는 데 사용할 수 있습니다. 관련 Sysmon 이벤트 ID에 대한 공격 데이터를 생성하기 위해 만들었습니다. 블로그 포스트: 이 도구는 블로그 포스트에서 설명되었습니다: https://rootdse.org/posts/understanding-sysmon-events/...

SpecuCheck

SpecuCheck SpecuCheck は、CVE-2017-5754 Meltdown、CVE-2017-5715 Spectre v2、CVE-2018-3260 Foreshadow、CVE-2018-3639 Spectre v4 に対するソフトウェアおよびハードウェアの緩和策の状態を確認するための Windows ユーティリティです。これは、2018 年 1 月に導入された最近のパッチの一部として NtQuerySystemInformation API 呼び出しに追加された 2 つの新しい情報クラスを使用し、Windows カーネルから見たデータを報告します。...

WinObjEx64

WinObjEx64 Windows 对象管理器浏览器 64位 WinObjEx64 是一款高级工具，可让您浏览 Windows 对象管理器命名空间。对于某些对象类型，您可以双击它或使用“属性...”工具栏按钮获取更多信息，例如描述、属性、资源使用情况等。如果您拥有所需的访问权限，WinObjEx64 允许您查看和编辑与对象相关的安全信息。 系统要求 WinObjEx64 不需要管理员权限。但是，查看大部分命名空间以及编辑与对象相关的安全信息需要管理员权限。 WinObjEx64 仅适用于以下 x64 Windows 系统：Windows 7、Windows 8、Windows 8.1 ...

CVE-2022-23611

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade...

Intel System Support Utility for Windows 代码问题漏洞

Intel System Support Utility for Windows is a Windows platform-based system support utility from Intel Corporation USA. The program is mainly used to identify the hardware model, operating system version, and software installed on the computer. A code issue vulnerability exists in Intel System...

EUVD-2022-28580

Malicious code in bioql PyPI...

Inteset Systems Secure Lockdown 安全漏洞

Inteset Systems Secure Lockdown is a Windows lockdown utility from Inteset Systems, Inc. Allows access to only desired applications from a highly customizable menu. A security vulnerability exists in Inteset Systems Secure Lockdown version v2.00.219, which stems from a vulnerability that allows a...

Cybercriminals Swarm Windows Utility Regsvr32 to Spread Malware

A Windows living-off-the-land binary LOLBin known as Regsvr32 is seeing a big uptick in abuse of late, researchers are warning, mainly spreading trojans like Lokibot and Qbot. LOLBins are legitimate, native utilities used daily in various computing environments, that cybercriminals use to evade...

Arbitrary file deletion

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible...

Out-of-Band Detection for Log4Shell

Log4j is the de facto logging library for all Java applications, as Log4j is used in most Java-based applications. The challenge is that Java applications that use the log4j-vulnerable library can be coded, packaged, and deployed using different methods – this introduces a challenge for detection...

CVE-2021-22980

In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility CTU for Windows could allow an attacker to load a malicious DLL library from its current directory. User...

Hackers compromised IObit forum to spread DeroHE ransomware

By Waqas Over the weekend, Windows utility developer IObit was hacked to facilitate a widespread attack for distributing the DeroHE ransomware. This is a post from HackRead.com Read the original post: Hackers compromised IObit forum to spread DeroHE ransomware...

North Korea-Backed Spy Group Poses as Reporters in Spearphishing Attacks, Feds Warn

The North Korean advanced persistent threat APT group known as Kimsuky is actively attacking commercial-sector businesses, often by posing as South Korean reporters, according to an alert from the U.S. Cybersecurity and Infrastructure Security Agency CISA. Kimsuky a.k.a. Hidden Cobra has been...

Despite Ringleader’s Arrest, Cobalt Group Still Active

Evidence has surfaced that the Cobalt Group – the threat actors behind widespread attacks on banks and ATM jackpotting campaigns across Europe – is continuing to operate, despite the arrest of its accused ringleader in March. The Cobalt Group, first burst on the scene in 2016: in a single night,...

MP3 Cutter 1.1.0 Registration Bypass

Document Title: =============== MP3 Cutter 1.1.0 - Reverse Engineering Issue Release Date: ============= 2016-09-05 Vulnerability Disclosure Timeline: ================================== 2016-09-15: Public Disclosure Common Vulnerability Scoring System: ==================================== 6 Produ...

Core Windows Utility Can Be Used to Bypass AppLocker

A core Windows command-line utility, Regsvr32, used to register DLLs to the Windows Registry can be abused to run remote code from the Internet, bypassing whitelisting protections such as Microsoft’s AppLocker. A researcher who requested anonymity found and privately disclosed the issue to...

DomainHostingView v1.61 - Show domain hosting information

DomainHostingView is a utility for Windows that collects extensive information about a domain by using a series of DNS and WHOIS queries, and generates HTML report that can be displayed in any Web browser. The information displayed by the report of DomainHostingView includes: the hosting company ...

Netzip Classic ZIP file parsing buffer overflow

Added: 11/04/2011 BID: 46059 Background Netzip Classic is a Windows utility for downloading and decompressing files. Problem A buffer overflow vulnerability allows command execution when a user opens a specially crafted ZIP file and double-clicks on the file contained in it. Resolution Do not use...

Netzip Classic ZIP file parsing buffer overflow

Added: 11/04/2011 BID: 46059 Background Netzip Classic is a Windows utility for downloading and decompressing files. Problem A buffer overflow vulnerability allows command execution when a user opens a specially crafted ZIP file and double-clicks on the file contained in it. Resolution Do not use...

CVE-2004-2527: Undefined Security Weakness

The local and remote desktop login screens in Microsoft Windows XP before SP2 and 2003 allow remote attackers to cause a denial of service CPU and memory consumption by repeatedly using the WinKey+"U" key combination, which causes multiple copies of Windows Utility Manager to be loaded more quick...