GhostPack/Seatbelt
Seatbelt
Seatbelt هو إطار عمل للأمن الهجومي بلغة C# ومدقق أمن المضيف مصمم لإجراء مسوحات لنقاط النهاية على أنظمة Windows. يعمل كأداة معيارية لتحديد الثغرات الأمنية، والتكوينات الخاطئة، والآثار ذات الصلة بالأمن على كل من المضيفين المحليين والبعيدين.
يتميز المشروع بنظام فحص قائم على الوحدات يسمح بدمج وحدات أوامر أمنية مخصصة. يتميز بمحلل سجل أحداث الأمان لتتبع نشاط تسجيل الدخول والعمليات، إلى جانب أداة استخراج بيانات الاعتماد لجمع سجل المتصفح، وكلمات المرور المحفوظة، وبيانات اعتماد السحابة من ملفات تعريف المستخدمين.
يغطي النظام مجالات قدرات واسعة بما في ذلك تعداد النظام عن بُعد، واكتشاف المضيف القائم على السجل، وتحليل أحداث الأمان. يمكنه جمع بيانات تكوين النظام المفصلة، مثل إعدادات مكافحة الفيروسات وقواعد الشبكة، وتصدير بيانات المسح الناتجة إلى تنسيقات JSON أو نصية.
Features
- Security Reconnaissance Tools - Provides a suite of reconnaissance tools for enumerating OS versions, antivirus settings, and network rules to identify attack vectors.
- Windows Evidence Collection - Gathers forensic artifacts including browser history, cloud credentials, and saved passwords from Windows systems.
- User Profile Artifacts - Implements specialized extraction of cloud credentials, browser history, and saved passwords from user profiles.
- System Enumeration Tools - Provides utilities to gather detailed operating system configuration, antivirus settings, and network rules for security auditing.
- Host Security Auditors - Provides a security auditor that runs safety checks on local and remote Windows systems to identify vulnerabilities.
- Credential Extraction Utilities - Implements utilities for recovering sensitive authentication secrets and credentials from user profiles and local databases.
- Local Security Auditing - Evaluates the security posture of local and remote machines to identify misconfigurations and vulnerabilities.
- Windows Enumeration - Enumerates Windows-specific system configurations, antivirus settings, and network rules to identify potential attack vectors.
- Offensive Security Frameworks - Provides a modular platform for vulnerability identification, host-based security research, and artifact detection.
- Scanning Module Systems - Features a modular architecture for organizing and grouping security check units into executable assessment profiles.
- Log File Parsing - Implements mechanisms for parsing system security logs to extract structured data regarding logon and process activity.
- Remote Query Execution - Provides capabilities for executing specialized queries on remote endpoints to retrieve system state and forensic data.
- Security Event Log Parsers - Provides an analysis tool that parses Windows event logs to identify sensitive logon and process activity.
- Security Event Monitoring - Analyzes system logs for malicious patterns and tracks user logon activity for threat hunting.
- Path Variable Resolvers - Resolves environment variables at runtime to locate and extract sensitive artifact files from user profile paths.
- Security Module Integrations - Allows the integration of custom security hunting modules to expand the library of detectable system artifacts.
- Registry-Based Software Detection - Queries the Windows registry to identify installed security software and specific operating system configurations.
- Host Situational Awareness - Performing security-oriented host survey checks.
- Active Directory Assessment - Gathers security configuration data from Windows hosts to identify vulnerabilities.
- Offensive Security Tools - Performs security-oriented host survey and safety checks.
- Privilege Escalation - Performs security auditing on Windows hosts.
