keepsecure-labs / artifacts

Detection artifacts, IOCs, and reproducers accompanying the analyses published at keepsecure.io/hub.

How this repo is organized

One folder per CVE. Folder name matches the hub post slug.

artifacts/
├── cve-2026-33824-windows-ike-unauth-rce/
├── cve-2026-33032-nginx-ui-auth-bypass-mcpwn/
└── ...

A typical folder contains:

• README.md — CVE summary and pointer to the hub analysis
• detections/ — Sigma, YARA, Suricata rules; KQL and Splunk queries
• iocs.csv — indicators of compromise (hashes, IPs, JA3s) when publicly available
• verify-patch.sh — optional script to check patch state on a host

Not every folder has every file. Some CVEs have no public IOCs; some don't warrant a reproducer; some ship only detection rules. Each folder holds whatever the analysis produced.

License

All artifacts are licensed under Apache-2.0. IOCs are factual and not subject to copyright.

Canonical analysis

Narrative, exploitation detail, and impact assessment live on the hub — this repo is the code-shaped counterpart. Every folder's README links back to the authoritative post.

Contributing

Corrections and additions via pull request are welcome. Canonical analysis is authored on the hub and shouldn't be duplicated here.