Threat-Hunting

Threat-Hunting | Detection Engineering Коллекция запросов для охоты за угрозами и обнаружения : CrowdStrike Falcon с использованием CQL – CrowdStrike Query Language Microsoft Defender XDR с использованием KQL – Kusto Query Language Направлена на выявление подозрительных процессов, аномального...

Hunting-Queries-Detection-Rules

KQL запросы Sentinel и Defender KQL для Defender XDR, Microsoft Sentinel и других решений Microsoft Цель этого репозитория — делиться KQL-запросами, которые могут использоваться любым человеком и быть понятными. Эти запросы предназначены для увеличения охвата обнаружения через логи продуктов...

KQL-threat-hunting-queries

KQL 쿼리를 사용한 위협 헌팅/탐지 | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE 1월 27일: 약 1년간의 기여 끝에, 이 저장소는 현재 커뮤니티 환경에 부응하고 보다 나은 맥락화를 제공하여 지속적인 기여를 이어가기 위해 대대적인 재구축을 진행 중입니다. 이 저장소는 분석가와...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Инженерная разработка обнаружений в работающей среде Microsoft Sentinel и Defender XDR, которой я управляю. Девять пользовательских аналитических правил охватывают три плоскости, каждое сопоставлено с MITRE ATT&CK и проверено от начала до конца: контролируемое...

GO-RPCBOMB

Описание: CVE-2017-8779 rpcbind до версии 0.2.4, LIBTIRPC до версии 1.0.1 и 1.0.2-rc до 1.0.2-rc3, а также NTIRPC до версии 1.4.3 не учитывают максимальный размер данных RPC при выделении памяти для строк XDR, что позволяет удаленным злоумышленникам вызвать отказ в обслуживании потребление памяти...

Cortex-XDR-Config-Extractor

Извлекатель конфигурации Cortex XDR ⚠️ Для получения дополнительной информации посетите https://laokoon-security.com/cortex-xdr-config-exctractor/ в настоящее время только на немецком языке Этот инструмент предназначен для использования во время оценки Red Team и аудита настроек XDR. С помощью...

CVE-2021-44228

CVE-2021-44228 Этот репозиторий содержит изменённые скрипты сообщества, связанные с CVE-2021-44228, перенесённые в среды EDR. Скрипты были модифицированы для совместимости с дополнительными требованиями других технологий. См. связанные репозитории для получения актуальной и оригинальной версии...

redsun-bluehammer-undefend-detection-pack

RedSun, BlueHammer, UnDefend 및 CrossFamily 탐지 팩 중요: 이 저장소의 모든 코드와 탐지 로직은 AI로 생성되었습니다. 이 스크립트가 정확하거나, 완전하거나, 안전하거나, 어떤 환경에 적합하다는 보장은 없습니다. 이 스크립트 사용에 따른 모든 책임은 전적으로 사용자에게 있습니다. 저장소 작성자는 이 콘텐츠 사용으로 인해 발생하는 손상, 중단, 데이터 손실, 오탐, 미탐, 운영 영향 또는 기타 피해에 대해 책임을 지지 않습니다. 모든 스크립트는 실제 운영 환경에 배포하기 전에 자격을 갖춘 담당자...

From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-And-Response Architectures

While the literature on blockchain-assisted intrusion detection and prevention systems IDS/IPS for Internet of Things IoT and Industrial Internet of Things IIoT networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward modern...

PT-2026-97895

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the system fails to reject Write or Reply chunks that have a segcount field set to zero. Because the xdr check write chunk function only...

Vulnerability of services for the NFS ONCRPC XDR driver on Windows operating systems, allowing a hacker to execute arbitrary code

The vulnerability of services for the NFS ONCRPC XDR driver on Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Astra Linux – Vulnerability in krb5

The file “lib/kadm5/kadmrpcxdr.c” in MIT Kerberos 5 also known as krb5 before versions 1.20.2 and 1.21.x before version 1.21.1 exposes an uninitialized pointer. A remotely authenticated user can cause a Kadmind crash. This occurs because the function xdrkadm5principalentrec does not validate the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: The encoder for NFSv2 GETACL results has been completed. The xdrstream conversion inadvertently left some code that set the pagelen of the send buffer. The XDR stream encoders should now handle this automatically. This...

The vulnerability in the virtual machine of the cloud security platform Palo Alto Networks Cortex XDR Broker VM allows a attacker to execute arbitrary code.

The vulnerability of the virtual machine on Palo Alto Networks’ Cortex XDR Broker VM for cloud security platforms is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-89673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the...

Linux Distros Unpatched Vulnerability : CVE-2026-89551

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each...

Linux Distros Unpatched Vulnerability : CVE-2026-89674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in eith...

Linux Distros Unpatched Vulnerability : CVE-2026-89544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller...

CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

CVE-2026-89673

A flaw was found in the Linux kernel's NFS daemon nfsd. A remote attacker could exploit an error in the XDR External Data Representation padding calculation within the ffencodegetdeviceinfo function. This mismatch between reserved and actual data size leads to the leakage of stale reply-page...