1.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
+180 stars
from 4,526 · score 5.20
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
14 repositories by Attention Score · May 7, 2026 – Nov 2, 2026 (UTC)
2.JPCERTCC / LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
+149 stars
from 3,150 · score 5.01
3.google / timesketch
Collaborative forensic timeline analysis
+145 stars
from 3,303 · score 4.98
4.RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
+143 stars
from 1,409 · score 4.97
5.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
+80 stars
from 1,684 · score 4.39
6.fox-it / dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
+80 stars
from 1,099 · score 4.39
7.Neo23x0 / Loki
Loki - Simple IOC and YARA Scanner
+71 stars
from 3,731 · score 4.28
8.yeti-platform / yeti
Your Everyday Threat Intelligence
+67 stars
from 1,971 · score 4.22
9.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+67 stars
from 804 · score 4.22
10.ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
+66 stars
from 1,032 · score 4.20
11.pedramamini / ThreatIngestor
Extract and aggregate threat intelligence.
+27 stars
from 905 · score 3.33
12.tomchop / malcom
Malcom - Malware Communications Analyzer
+7 stars
from 1,167 · score 2.08
13.dfirtrack / dfirtrack
DFIRTrack - The Incident Response Tracking Application
+7 stars
from 533 · score 2.08
14.pedramamini / iocextract
Defanged Indicator of Compromise (IOC) Extractor.
+6 stars
from 575 · score 1.95