
LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
ai-securitydigital-forensicsincident-response+2
3.3k2 months ago

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

Proof-of-concept demonstrating log injection and poisoning in Splunk via crafted URL parameters, highlighting OWASP log injection risks.

Executes untrusted Python, JavaScript, and Bash in a hardened jail with 5-second, 128 MB, 0.5-core, PID and output limits.