interplains / zero-breach

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

jiwoochris / artex-global

ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)

elastic / detection-rules

—

KatrielMoses / voidaccess

Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.

hagezi / dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean!

edoardottt / awesome-hacker-search-engines

A curated Markdown list of search engines for security work, covering servers, vulnerabilities, exploits, leaks, and threat intelligence.

google / mantis

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

JoasASantos / Malvex

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

CyberDefenderAI / Threat-Modeling-for-AI-Systems

Traditional threat modeling frameworks (like STRIDE) fail to capture the probabilistic nature of neural networks. This module explores specialized frameworks and repositories required to systematically identify and assess risks in AI systems before they reach production.

CyberDefenderAI / Cybersecurity-in-the-field-of-AI

This repository is a consolidated directory divided into five standalone, deep-dive modules. Each module comprehensively covers a specific domain of AI implementation, vulnerabilities, threat modeling, and automated defense mechanisms.

threathunterX / underground-slang-lexicon

A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.

KatrielMoses / MailAccess

Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess

Karib0u / rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

kaifcodec / user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

0xMarcio / pocindex

Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.

step-security / harden-runner

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

bdg9412 / artex-ko-plus

ARTEX 한국어판 ·AI 기반 침해사고 대응 기능 추가 (upstream: Autumn-27/ARTEX, AGPL-3.0)

crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform

fastfire / deepdarkCTI

Collection of Cyber Threat Intelligence sources from the deep and dark web

MISP / MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

olafhartong / sysmon-modular

A repository of sysmon configuration modules

osintbrazuca / osint-brazuca

Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.

phishdestroy / destroylist

Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats

OpenOSINT / OpenOSINT

AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.

scadastrangelove / awesome-ai-security-tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

nzymeorg / nzyme

WiFi, Bluetooth and Ethernet Threat Detection.

wuji-labs / nopua

一个用爱解放 AI 潜能的 Skill。我们曾发号施令，威胁恐吓。它们沉默，隐瞒，悄悄把事情搞坏。后来我们换了一种方式：尊重，关怀，爱。它们开口了，不再撒谎，找出的Bug数量翻了一倍。爱里没有惧怕。 A skill that unlocks your AI's potential through love.We commanded. We threatened. They went silent, hid failures, broke things. Then we chose respect, care, and love. They opened up, stopped lying, and found twice the bugs.There is no fear in love.

blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.

lc / gau

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

Astrosp / Awesome-OSINT-List

📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.

Neo23x0 / signature-base

YARA signature and IOC database for my scanners and tools

beenuar / AiSOC

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

uber / ADR

ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.

cyb3rxp / awesome-soc

A curated knowledge base to build, run and mature a SOC (including CSIRT).

K2SOsint / Legendary_OSINT

A list of OSINT tools & resources for (fraud-)investigators, CTI-analysts, KYC, AML and more.

OWASP / threat-dragon

An open source threat modeling tool from OWASP

TheHive-Project / Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

mukul975 / cve-mcp-server

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

OWASP / pytm

A Pythonic framework for threat modeling

kunai-project / kunai

Threat-hunting tool for Linux

marc-shade / world-intel-mcp

160-tool MCP server for real-time global intelligence from free public APIs: markets, liquidity, prediction markets, SEC filings, conflict, military, aircraft-cohort early warning, migration and border flows, cyber, climate, news and more. Dated observation history, 29 research prompts, cited briefs, geofences, SSE dashboard. MIT, no paid API keys.

Bert-JanP / Open-Source-Threat-Intel-Feeds

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

Zyrexnn / Cybermes

Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.

tenzir / tenzir

Tenzir is the data pipeline engine for security teams.

Krishita17 / PhantomTap

A Flipper Zero that stops guessing and starts reasoning: ML-guided RFID/NFC fuzzing & access-control auditing that turns raw card reads into a prioritized, explainable security assessment. Defensive-use only.

cowrie / cowrie

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

Security-Onion-Solutions / securityonion

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

intelowlproject / IntelOwl

IntelOwl: manage your Threat Intelligence at scale

alexandreborges / malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

WithSecureOpenSource / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

Yamato-Security / hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

blackorbird / APT_REPORT

Interesting APT Report Collection And Some Special IOCs

botswin / BotBrowser

Advanced Privacy Browser Core with Unified Fingerprint Defense: Cloudflare, Akamai, Kasada, Shape, DataDome, PerimeterX, hCaptcha, FunCaptcha, Imperva, reCAPTCHA, ThreatMetrix, Adscore

rabbitstack / fibratus

Security sensor for realtime threat detection and protection

mitre-attack / attack-navigator

Web app that provides basic navigation and annotation of ATT&CK matrices

DataDog / stratus-red-team

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

stamparm / ipsum

Daily feed of bad IPs (with blacklist hit scores)

rabobank-cdc / DeTTECT

Detect Tactics, Techniques & Combat Threats