A repository of sysmon configuration modules
- sysmon
- dfir
- threat-hunting
- mitre-attack
Repository Index
47,133 repositories indexed
1–24 of 33 · Most stars
Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
- android-application
- security-analysis
- dynamic-analysis
- xposed
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
- rootkit
- lkm-rootkit
- c
- kernel
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
pefile is a Python module to read and work with PE (Portable Executable) files
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
OpenID Certified™ OpenID Connect and FAPI 2 Relying Party module for Apache HTTPd
- apache-httpd
- openid-connect
- openidconnect-client
- openidc
Framework for Making Environmental Keyed Payloads (NO LONGER SUPPORTED)
- powershell
- golang
- python
- clueless-agents
Tiny hashing module that uses the native crypto API in Node.js and the browser
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
🛡 Official AI Security Tool module for CVE-2026-54121 (Certighost): AD CS certificate abuse deep-dive, defensive audit workflows, and safe in-app console execution for authorized Active Directory security testing.
- active-directory
- ai-security-tool
- privilege-escalation
- red-team
Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators
- loadable-kernel-modules
- android-lkms
- emulators
- kernel
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
- ai-hacking
- ai-security-tool
- cve-scanning
- cve-tools
CLI utility and Python module for analyzing log files and other data.
- log-analysis
- log-parser
- cli
- security
Magento 2 GDPR module is a must have extension for the largest e-commerce CMS used in the world. The module helps to be GDPR compliant. Actually it allows the customers to erase, or export their personal data. As a merchant you have powerful tools to customize the extension capabilities and apply the finest privacy rules.
Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers
A micro HTTP Web client for MicroPython (used on Pycom modules & ESP32)
- micropython
- esp32
- pycom
- web-client
PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
go-fasttld is a high performance effective top level domains (eTLD) extraction module.
- compressed-trie
- idn
- idna
- ipv4
PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
- powershell
- powershell-modules
- incident-response
- containment
Dropwizard bundle managing authentication through JWT cookies
- jwt
- cookie
- java
- dropwizard
A simple, secure, and highly configurable Elixir identity [username | email | id | etc.]/password authentication module to use with Ecto.