elastic / detection-rules
—
elastic / detection-rules
OISF / suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
osintbrazuca / osint-brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
olafhartong / sysmon-modular
A repository of sysmon configuration modules
Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
sroberts / awesome-iocs
Curated sources of indicators of compromise, detection signatures and IOC tools.
WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
kunai-project / kunai
Threat-hunting tool for Linux
Bert-JanP / Open-Source-Threat-Intel-Feeds
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
joshuagodwin7929 / Purple-Team-Automation
Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.
Security-Onion-Solutions / securityonion
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
alexandreborges / malwoverview
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.
yeti-platform / yeti
Your Everyday Threat Intelligence
thalesgroup-cert / Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
ninoseki / mihari
A query aggregator for OSINT based threat hunting
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
tsale / jevline
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
Neo23x0 / signature-base
YARA signature and IOC database for my scanners and tools
rabbitstack / fibratus
Security sensor for realtime threat detection and protection
cyb3rxp / awesome-soc
A curated knowledge base to build, run and mature a SOC (including CSIRT).
jacobdjwilson / awesome-annual-security-reports
A curated list of annual cyber security reports
TonyPhipps / SIEM
SIEM Tactics, Techiques, and Procedures
activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
MISP / misp-galaxy
Clusters and elements to attach to MISP events or attributes (like threat actors)
SagarBiswas-MultiHAT / awesome-cybersecurity-paths
The complete cybersecurity career roadmap and handbook. 36 roles across pentesting, red teaming, bug bounty, SOC, incident response, digital forensics, cloud security, DevSecOps, threat hunting, OSINT, and GRC. Each role covers skills, 150+ tools, 50+ certifications, and career progression paths.
blackorbird / APT_REPORT
Interesting APT Report Collection And Some Special IOCs
Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
cyb3rmik3 / KQL-threat-hunting-queries
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
drb-ra / C2IntelFeeds
Automatically created C2 Feeds
google / mcp-security
—
SyntaxMethod / CVE-2026-42978-PoC-Research
CVE-2026-42978 Windows Push Notifications (WpnService) Use-After-Free & Race Condition PoC research, diagnostic scanner, and security audit module for AI Security Tool.
huntbase-io / hunt-md
hunt.md: an open, plain-text format for threat hunts. Spec, examples and tooling.
karim852 / Kage-DFIR-toolkit
Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
EmadAbedini / Dumplyzer
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python
utmstack / UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
0x783kb / Threat-Analysis-Handbook
常见的攻击行为监测特征及方法，涵盖端点和流量，未包含PowerShell和Sysmon。预祝运营生活愉快！