817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Repository Index
47,133 repositories indexed
1–24 of 41 · Most stars
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
- footprinting
- osint
- threatintel
- python
Exploitation Framework for Embedded Devices
The recursive internet scanner for hackers. 🧡
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
The FLARE team's open-source tool to identify capabilities in executable files.
- malware-analysis
- reverse-engineering
- binary-analysis
- threat-intelligence
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
- phishing
- typosquatting
- domains
- dns
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
The repository host gives no description.
- threat-detection
- threat-hunting
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
Your Everyday Threat Intelligence
- infosec
- threatintel
- threat-sharing
- threat-hunting
Phishing catcher using Certstream
- phishing
- threat-intelligence
- certificate-transparency
- osint
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Malcom - Malware Communications Analyzer
- malware
- network-traffic
- pcap
- threat-intelligence
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
- cybersecurity
- threat
- ioc
- malware
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence
Scirius is a web application for Suricata ruleset management and threat hunting.
- python
- security
- management
- interface
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Learn cloud security by building it! An open-source homelab teaching Zero Trust, DevSecOps, IaC, and cloud architecture from the ground up.
Tool to gather Threat Intelligence indicators from publicly available sources
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor