Repository Index

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

• ai-agents
• claude-code
• cybersecurity
• incident-response

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

• phishing
• typosquatting
• domains
• dns

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

No description provided by the repository host.

• threat-detection
• threat-hunting

Your Everyday Threat Intelligence

• infosec
• threatintel
• threat-sharing
• threat-hunting

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

Scirius is a web application for Suricata ruleset management and threat hunting.

• python
• security
• management
• interface

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

• claude-code
• cti
• llm
• rag

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack