Incident Response

simonis/log4jpatch

Deploys an agent to fix CVE-2021-44228 (Log4j RCE vulnerability) in a running JVM process

cert-lv/exchange_webshell_detection

Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857,…

tg12/dns-honeypot

dns-honeypot

mandiant/ioc-scanner-cve-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

alexverboon/psmdatp

PowerShell Module for managing Microsoft Defender Advanced Threat Protection

mandiant/citrix-ioc-scanner-cve-2023-3519

Bash-based scanner detecting indicators of compromise from CVE-2023-3519 exploitation on Citrix ADC appliances, supporting live and forensic image…

deadbits/yara-rules

Collection of YARA signatures from individual research

stripe/log4j-remediation-tools

Tools for remediating the recent log4j2 RCE vulnerability (CVE-2021-44228)

playtikaoss/leaktopus

Automated secret and leak detection scanner for GitHub and paste sites, with heuristic filtering, IOL enrichment via Shhgit/TruffleHog, and ELK-based…

cisagov/check-your-pulse

This utility can help determine if indicators of compromise (IOCs) exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510.

soteria-security/hafnium-ioc

A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865

qixils/anticropalypse

Discord bot for mitigating the aCropalypse vulnerability (CVE-2023-21036, CVE-2023-28303) by retroactively deleting vulnerable images

jenkinsci-cert/security-218

Disables Jenkins CLI/Remoting subsystem as a mitigation against unauthenticated remote code execution vulnerabilities SECURITY-218 and SECURITY-360,…

kolya5544/bearftp

Honeypot FTP server written in .NET Core (C#) for both Linux and Windows.

m-mizutani/alertresponder

Automatic security alert response framework by AWS Serverless Application Model

notawful/cve-2017-0199-fix

Quick and dirty fix to OLE2 executing code via .hta