Repository Index

Phishing catcher using Certstream

• phishing
• threat-intelligence
• certificate-transparency
• osint

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Malcom - Malware Communications Analyzer

• malware
• network-traffic
• pcap
• threat-intelligence

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

• cybersecurity
• threat
• ioc
• malware

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

Scirius is a web application for Suricata ruleset management and threat hunting.

• python
• security
• management
• interface

MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

Tool to gather Threat Intelligence indicators from publicly available sources

Defanged Indicator of Compromise (IOC) Extractor.

• ioc
• indicators-of-compromise
• library
• ioc-extractor

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations.

• python
• mqtt
• mqtt-broker
• mqtt-client

OASIS TC Open Repository: Python APIs for STIX 2

• python
• stix
• stix2
• cyber-threat-intelligence

Cyber Incident Response Team Playbook Battle Cards

• playbook-battle-cards
• cybersecurity
• cyber-threats
• cyber-security-team

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

• ids
• teler
• waf
• teler-ids

A Python RESTful API framework for online malware analysis and threat intelligence services.

• python
• cybersecurity
• malware
• malware-analysis

Python installable command line utiltity for mitigation of host and key compromises.

Splunk code (SPL) for serious threat hunters and detection engineers.

• splunk
• threat-hunting
• use-case
• siem