arkha-corvus/letsdefend-soc173-follina-0-day-detectedWe are presented with a security alert indicating the detection of the Follina (CVE-2022-30190) vulnerability. A malicious Word document triggered…
vignesh-hp/lockbit-ransomware-analysisThreat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).
pazhanivelmani/libexif_android10_r33_cve-2016-6328C-based library for parsing, editing, and saving EXIF metadata from JPEG images, with a focus on exploiting CVE-2016-6328 for Android 10.
macuchegit/detecting-and-analyzing-cve-2024-24919-exploitationStep-by-step walkthrough of detecting and analyzing CVE-2024-24919 exploitation using a SIEM platform, including traffic analysis, IOC documentation,…
cyberbibs/soc274---palo-alto-networks-pan-os-command-injection-vulnerability-exploitation-cve-2024-3400-Step-by-step SOC analyst walkthrough for investigating and remediating CVE-2024-3400 (PAN-OS command injection). Covers detection, log analysis,…
bridg3ops/soc335-cve-2024-49138-exploitation-detectedDetailed incident response walkthrough analyzing CVE-2024-49138 exploitation on Windows, covering process tree analysis, IOC identification, and…
michaael01/letsdefend--soc-342-cve-2025-53770-sharepoint-exploit-toolshellDetailed walkthrough of CVE-2025-53770 (ToolShell) SharePoint zero-day exploitation, including RCE analysis, MachineKey exfiltration, payload…
cyprianatsyor/toolshell-cve-2025-53770-sharepoint-exploit-lab-letsdefendStep-by-step walkthrough of exploiting CVE-2025-53770 (ToolShell) in a LetsDefend lab, covering RCE, web shell deployment, and incident response…
deividasterechovas/soc335-cve-2024-49138-exploitation-detectedDocumented incident response case for CVE-2024-49138 exploitation, featuring log analysis, hash validation, C2 detection, and containment procedures…
cyprianatsyor/letsdefend-cve-2024-49138-investigationHands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.
remnux/distroProvides supplemental files and Debian package sources for a specialized Linux distro focused on malware analysis, reverse engineering, and digital…
basitsajidapply-stack/soc-investigation-cve-2024-49138Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
rizinorg/rizinUNIX-like reverse engineering framework and command-line toolset.
volatilityfoundation/dwarf2jsonconvert ELF/DWARF symbol and type information into vol3's intermediate JSON
jwa7470/cve-2026-20131-post-incident-written-reportPost-incident report on CVE-2026-20131 (CVSS 10.0), a Cisco FMC insecure deserialization vulnerability exploited by Interlock ransomware. Details…
shahidmallaofficial/cpanel-cve-2026-41940-fixOne-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and…
ercihan/cve-2026-34621_pdf_sampleTechnical analysis of a multi-stage Adobe Acrobat PDF JavaScript sample, detailing environment triage, Acrobat API abuse, and in-memory payload…
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
