1.interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
+561 stars
from 549 · score 6.33
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
27 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.mukul975 / Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
+392 stars
from 35,012 · score 5.97
3.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
+115 stars
from 17,418 · score 4.75
4.pranshuparmar / witr
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
+106 stars
from 22,789 · score 4.67
5.oxynote / oxynote
An open‑source technical wiki connected to the systems it describes
+89 stars
from 373 · score 4.50
6.volatilityfoundation / volatility3
Volatility 3.0 development
+26 stars
from 4,533 · score 3.30
7.Velocidex / velociraptor
Digging Deeper....
+26 stars
from 4,376 · score 3.30
8.meirwah / awesome-incident-response
A curated list of tools for incident response
+20 stars
from 9,501 · score 3.04
9.kubeshark / kubeshark
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
+14 stars
from 12,108 · score 2.71
10.Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
+14 stars
from 3,415 · score 2.71
11.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
+13 stars
from 513 · score 2.64
12.sleuthkit / sleuthkit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
+10 stars
from 3,173 · score 2.40
13.0x4D31 / awesome-threat-detection
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
+8 stars
from 4,771 · score 2.20
14.Mutasem-mk4 / procscope
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
+8 stars
from 37 · score 2.20
15.dastergon / awesome-sre
A curated list of Site Reliability and Production Engineering resources.
+7 stars
from 13,741 · score 2.08
16.dfir-iris / iris-web
Collaborative Incident Response platform
+4 stars
from 1,612 · score 1.61
17.tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
+4 stars
from 1,501 · score 1.61
18.DFIRKuiper / Kuiper
Digital Forensics Investigation Platform
+4 stars
from 909 · score 1.61
19.last-byte / PersistenceSniper
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
+2 stars
from 2,147 · score 1.10
20.dastergon / postmortem-templates
A collection of postmortem templates
+2 stars
from 1,459 · score 1.10
21.emalderson / ThePhish
ThePhish: an automated phishing email analysis tool
+1 stars
from 1,381 · score 0.69
22.cyb3rfox / Aurora-Incident-Response
Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
+1 stars
from 1,085 · score 0.69
23.counteractive / incident-response-plan-template
A concise, directive, specific, flexible, and free incident response plan template
+1 stars
from 809 · score 0.69
24.tenzir / tenzir
Tenzir is the data pipeline engine for security teams.
+1 stars
from 768 · score 0.69
25.activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
+1 stars
from 666 · score 0.69
26.DFIR-ORC / dfir-orc
Forensics artefact collection tool for systems running Microsoft Windows
+1 stars
from 452 · score 0.69
27.mgreen27 / Invoke-LiveResponse
Invoke-LiveResponse
+1 stars
from 151 · score 0.69