Trending repositories for topic threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, a...
Rapidly Search and Hunt through Windows Forensic Artefacts
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Threa...
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Discover and track internet assets using favicon hashes through search engines.
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files
Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Discover and track internet assets using favicon hashes through search engines.
Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.
Bringing you the best of the worst files on the Internet.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, a...
Rapidly Search and Hunt through Windows Forensic Artefacts
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Threa...
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, a...
Rapidly Search and Hunt through Windows Forensic Artefacts
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Threa...
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
Discover and track internet assets using favicon hashes through search engines.
Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files
M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.
Sysmon configuration file template with default high-quality event tracing
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Discover and track internet assets using favicon hashes through search engines.
Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files
M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.
Raw data from Threat Intelligence Reports with automatic reports collection and keyword search across thousands of reports
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
A large repository of malware samples with 2500+ malware samples & source codes for a variety of platforms by Cryptware Apps.
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Bringing you the best of the worst files on the Internet.
This repo is about Active Directory Advanced Threat Hunting
A curated list of annual cyber security reports
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
This repository contains indicators of compromise (IOCs) of our various investigations.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, a...
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Threa...
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
A resource containing all the tools each ransomware gangs uses
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, a...
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
A curated list of annual cyber security reports
Rapidly Search and Hunt through Windows Forensic Artefacts
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.
Raw data from Threat Intelligence Reports with automatic reports collection and keyword search across thousands of reports
A curated list of annual cyber security reports
Discover and track internet assets using favicon hashes through search engines.
A resource containing all the tools each ransomware gangs uses
ADXFlowmaster helps SecOps teams Threat Hunt suspicious network traffic inside & outside of Azure.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.
Set of SIGMA rules (>320) mapped to MITRE ATT&CK tactic and techniques
Awesome list of keywords and artifacts for Threat Hunting sessions
pretrained BERT model for cyber security text, learned CyberSecurity Knowledge
Sublime rules for email attack detection, prevention, and threat hunting.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Raw data from Threat Intelligence Reports with automatic reports collection and keyword search across thousands of reports
ADXFlowmaster helps SecOps teams Threat Hunt suspicious network traffic inside & outside of Azure.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, a...
A resource containing all the tools each ransomware gangs uses
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Rapidly Search and Hunt through Windows Forensic Artefacts
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Sysmon configuration file template with default high-quality event tracing
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Threa...
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
A resource containing all the tools each ransomware gangs uses
LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...
A curated list of annual cyber security reports
yara detection rules for hunting with the threathunting-keywords project
Newly registered Domain Monitoring to detect phishing and brand impersonation with subdomain enumeration and source code scraping
Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
Awesome list of keywords and artifacts for Threat Hunting sessions
Cover various security approaches to attack techniques and also provides new discoveries about security breaches.
AttacKG: Constructing Knowledge-enhanced Attack Graphs from Cyber Threat Intelligence Reports
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Purpleteam scripts simulation & Detection - trigger events for SOC detections
An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat I...
Sigma detection rules for hunting with the threathunting-keywords project
This repo is about Active Directory Advanced Threat Hunting