A repository of sysmon configuration modules
- sysmon
- dfir
- threat-hunting
- mitre-attack
Repository Index
47,133 repositories indexed
25–48 of 110 · Most stars
The repository host gives no description.
- threat-detection
- threat-hunting
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
Windows Events Attack Samples
- threat-hunting
- evtx
- windows-security
- mitre-attack
Security sensor for realtime threat detection and protection
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
- rootkit
- lkm-rootkit
- c
- kernel
Your Everyday Threat Intelligence
- infosec
- threatintel
- threat-sharing
- threat-hunting
A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.
- threat-modeling
- practical-devsecops
- security-review
- devsecops-university
Phishing catcher using Certstream
- phishing
- threat-intelligence
- certificate-transparency
- osint
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.
- api-security
- application-security
- kubernetes
- nginx
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
A Suricata based NDR distribution
- suricata
- network
- security
- monitoring
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
ThePhish: an automated phishing email analysis tool
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
- detection-engineering
- splunk
- mitre
- awesome-list
Periodic cyber security newsletters that capture the latest news, summaries of conference talks, research, best practices, tools, events, vulnerabilities, and analysis of trending threats and attacks
- cybersecurity
- newsletter
Virtual Machine for Adversary Emulation and Threat Hunting
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Malcom - Malware Communications Analyzer
- malware
- network-traffic
- pcap
- threat-intelligence
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
- cybersecurity
- threat
- ioc
- malware
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence