#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
withsecurelabs/doublepulsar-detection-scriptA python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
beelzebub-labs/beelzebubA secure low code deception runtime framework, leveraging AI for System Virtualization.
comodosecurity/openedrOpen EDR public repository
threathuntingproject/threathuntingAn informational repo about hunting for adversaries in your IT environment.
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
bytedance/elkeidElkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It…
iknowjason/awesome-cloudsec-labsAwesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.
mattnotmax/cyberchef-recipesA list of cyber-chef recipes and curated links
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
stackrox/stackroxThe StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides…
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
thalesgroup-cert/watcherAI-powered threat intelligence platform for automated CVE/ransomware monitoring, domain surveillance, data leak detection, and incident response with…
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
jtsylve/limeKernel module for volatile memory acquisition from Linux and Android devices, producing forensically sound captures to disk or over the network.
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
