SecurePoC: A Helping Hand to Identify Malicious CVE Proof of Concept Exploits in GitHub
summary
A tool called SecurePoC modular tool triages GitHub-hosted CVE PoCs by extracting encoded blobs, IOCs, URLs and binaries and querying VirusTotal/AbuseIPDB; the authors collect 20,433 GitHub PoC repos (CVE-2016–2024) and find ≈2.5% flagged malicious. Detections include layered Base64/hex deobfuscation, flagged binaries that download persistence payloads, and miner campaigns attributed to a threat actor; the tool surfaces likely-malicious lines to prioritize sandboxed dynamic analysis.
AI-written summary · about
chapters (11)
- 0:00SecurePoC introduction
- 1:15Malicious PoCs on GitHub
- 3:43Motivation for SecurePoC
- 5:53PoC data analysis
- 8:00Tool architecture and detection modules
- 10:50False vs true positives
- 11:55PI Armor obfuscation
- 13:02Crypto miner detection
- 14:26BlueKeep exploit
- 15:28Live SecurePoC demo
- 16:32Future plans
related talks
17mIs My (Open Source) Project Safe?
32mWeaponizing Python for Good: Building a Next-Gen CVE Scanner That Detects Zero-Day Vulnerability
37mAutomatic Extraction of Indicators of Compromise for Web App.
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
16mUnpacking Open Source Security in Public Repos
42mKeynote: The Expanding Universe of Cyber Threats
43mHow to hack and defend (your) open source
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting