OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Repository Index
47,133 repositories indexed
25–48 of 225 · Most stars
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.
LinkStack - the ultimate solution for creating a personalized & professional profile page. Showcase all your important links in one place, forget the limitation of one link on social media. Set up your personal site on your own server with just a few clicks.
- php
- blade
- laravel
- self-hosted
The Hunting ELK
- hunting
- elasticsearch
- kibana
- logstash
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
🛡 A GraphQL tool to ease the creation of permission layer.
- graphql
- permissions
- server
- shield
Privacy-first password manager with built-in email aliasing. Fully encrypted and self-hostable.
- argon2id
- blazor
- dotnet
- password-manager
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
A family of header-only, very fast and memory-friendly hashmap and btree containers.
- hash
- tables
- unordered-map
- unordered-set
A repository of sysmon configuration modules
- sysmon
- dfir
- threat-hunting
- mitre-attack
Cecil is a library to inspect, modify and create .NET programs and libraries.
- dotnet
- library
- bytecode
- cil
The repository host gives no description.
- threat-detection
- threat-hunting
Create randomly insecure VMs
- security
- security-vulnerability
- virtualization
- randomization
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
Windows Events Attack Samples
- threat-hunting
- evtx
- windows-security
- mitre-attack
Security sensor for realtime threat detection and protection
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
- rootkit
- lkm-rootkit
- c
- kernel
🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.
- adversarial-ai
- claude-code
- cursor
- electron-security
Streamline your web application's authentication with Polis, an SSO service supporting SAML and OpenID Connect protocols. Beyond enterprise-grade Single Sign-On, it also supports Directory Sync via the SCIM 2.0 protocol for automatic user and group provisioning/de-provisioning.
- enterprise-software
- saml
- saml2
- saml-service-provider
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
- crack
- zip
- multithread
- attack
pefile is a Python module to read and work with PE (Portable Executable) files
Your Everyday Threat Intelligence
- infosec
- threatintel
- threat-sharing
- threat-hunting