I wanted to share a project I’ve been working on called DarkDiskz. It’s an open-source Python/GTK4 GUI tool that combines several disk-related utilities in one place. The goal is to make it easier to see drive information and manage sto…

Linux Tipps & Hardening reddit.com 01.07.2025, 01:04 Uhr 2 Min. Lesezeit

↗ Quelle (reddit.com)

Reagiere als Erste:r — dein Feedback zählt!

I wanted to share a project I’ve been working on called DarkDiskz.

It’s an open-source Python/GTK4 GUI tool that combines several disk-related utilities in one place. The goal is to make it easier to see drive information and manage storage setups without juggling a bunch of separate commands.

🔹 Features:

View detailed disk information (lsblk, lshw)
Run SMART health tests
Benchmark disks
Manage RAID (RAID 1/0)
Set up and monitor bcache
Configure fstab entries

⚠️ Important Notice (Please Read):
This is an early project by an amateur coder, so:

Some functions may not work perfectly.
There could be bugs.
You could lose data if you use destructive operations like wiping drives or re configuring RAID.

💡 Please back up all important data before testing or using any of the write/format functions. Use at your own risk.

🎯 About Me:
I’m not much of a programmer—this is my first serious attempt at making something useful for the Linux community. I’m hoping others might try it out, give feedback, report issues, or even contribute improvements. I probably wont change or edit the program any farther maybe the community enjoys this I hope so.

🔗 GitHub Repo:
👉 https://github.com/dark-ant616/DarkDiskz

If you’re interested, I’d really appreciate:

Testing on different distros (I did all testing on Linux Mint)
Bug reports and suggestions
Contributions to help make it better and more reliable

Thanks for taking the time to check it out!

submitted by /u/Dark_ant007
[link] [comments]

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - DarkDiskz – a simple open-source Linux GUI for disks, RAID, bcache, and SMART (early version, feedback welcome!)
id: 6ea08856-21a6-4226-9745-410f79ca77b1
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "DarkDiskz – a simple open-sour" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("DarkDiskz  a simple open-source Linux GU")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*DarkDiskz  a simple open-source Linux GU*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "DarkDiskz  a simple open-source Linux GU"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Gak gagal

Sichere Programmierung

NÄCHSTER BEITRAG 6 Min

Which Code Assistant Actually Helps Developers Grow? Part 2

Sichere ProgrammierungWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich DarkDiskz – a simple open-source Linux G.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')