BlockBlock provides continual protection by monitoring persistence locations.
Repository Index
47,133 repositories indexed
25–48 of 76 · Most stars
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
- anti-crawling
- cloud-native
- crawler
- deception
A work-in-progress deobfuscator for movfuscated binaries
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Ronin is a Free and Open Source Ruby Toolkit for Security Research and Development. Ronin also allows for the rapid development and distribution of code, exploits, payloads, etc, via 3rd-party git repositories.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Codesign Electron macOS apps
- electron-osx-sign
- macos
- entitlements
- provisioning-profiles
Automated Attack Simulation in the Cloud, complete with detection use cases.
honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Collection of example YARA-L rules for use within Google Security Operations
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
A Linux packet crafting tool.
- packet-crafting
- networking
- hacking-tool
- intrusion-prevention
A Suricata Docker image.
- suricata
- ids
- nsm
- docker
Linux Security and Monitoring Scripts
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
Universal web application security sensor intended for real-time monitoring and defense.
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
A pintool in order to unpack malware
HTTP/2 Last Frame Synchronization (also known as Single Packet Attack) low Level Library / Tool based on Scapy + Exploit Timing Attacks
- http2
- race-condition
- race-conditions
- scapy
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
Botnet command & control monitor
gonids is a library to parse IDS rules, with a focus primarily on Suricata rule compatibility. There is a discussion forum available that you can join on Google Groups: https://groups.google.com/forum/#!topic/gonids/
- suricata
- parse
- security-tools
- network-security
Suricata rules for network anomaly detection
- suricata-rule
- suricata
- ids
- nsm