#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
mvlnetdev/cve-2021-31166-detection-rulesDifferent rules to detect if CVE-2021-31166 is being exploited
streghstreek/cve-2020-1938Detection rules for CVE-2020-1938 (Ghostcat) vulnerability in Apache Tomcat AJP connector, with Suricata and Bro signatures for network-based…
rickgeex/cve-2025-5777-citrixbleedCitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”
millikanjohnl-blip/dirtyfrag-detection-rulesDetection rules and analysis for Dirty Frag (CVE-2026-43284/CVE-2026-43500) Linux kernel LPE vulnerability. Based on community research and health…
pavanaa4k/cve-2023-46604-labDetection, Exploit and Mitigation for CVE 2023 46604.
nstcyber/cve-2023-24488-siem-sigma-ruleDetect CVE-2023-24488 Exploitation Attempts
vaishnavucv/project-vuln-detection-n-mitigation_101Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization…
0xxon/cve-2020-0601-pluginZeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts
m5050/cve-2019-0604CVE-2019-0604: SharePoint RCE detection rules and sample PCAP
te0rwx/cve-2025-32433-detectionCustom YARA rule for detecting artifacts of CVE-2025-32433, an Erlang/OTP SSH pre-authentication RCE vulnerability. Validated against public PoCs and…
dorser/cve-2024-21626Educational demo of CVE-2024-21626 runc container escape with eBPF-based detection gadget for exploitation attempts.
r4j3sh-com/cve-2025-55182Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182.
corelight/detect-ransomware-filenamesZeek script that monitors SMB traffic and alerts on known ransomware filenames using the Anti-Ransomware File System Resource Manager list.
trustedsec/artilleryOpen-source blue team tool that protects Linux and Windows systems using multiple host and network defense and detection methods.
