#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
0x4d31/santamonLightweight macOS detection agent built on Santa’s Endpoint Security telemetry.
0xe7/wonkavisionDetects forged Kerberos tickets by dumping session and ticket data, scoring anomalies, and generating Windows event-log indicators for SIEM-based…
matheuzsecurity/ksentinelLinux kernel integrity monitor for detecting syscall hooking
kube-tarian/tarianeBPF-based runtime security agent for Kubernetes that detects unknown processes and file changes, enforces pre-registered constraints, and automates…
rbidou/pyraspRuntime Application Self Protection for Python web servers, serverless functions and MCP servers, detecting attacks, prompt injection and data leaks…
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
randomaccess3/detectionsCurated repository of detection information and validation guidance for identifying malicious activity in enterprise environments.
petabi/snifflesSniffles: Packet Capture Generator for IDS and Regular Expression Evaluation
corelight/threat-hunting-guideStructured guide to threat hunting using Zeek logs, aligned with MITRE ATT&CK framework for proactive detection of adversary tactics and techniques.
nccgroup/ip-reputation-snort-rule-generatorA tool to generate Snort rules based on public IP reputation data
ncsc-nl/citrix-2025Digital forensics and incident response tool using YARA rules to scan Citrix NetScaler core dumps, disk images, and live hosts for signs of…
fksvs/siperXDP Based Lightweight and Fast Firewall
julioliraup/antiphishingAdvanced Phishing Protection: Suricata rulesets open and free
alloysecuregroup/phantomfsWindows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…
rushyo/vindicatetoolLLMNR/NBNS/mDNS Spoofing Detection Toolkit
delivr-to/detectionsA home for detection content developed by the delivr.to team
corelight/zeek-long-connectionsZeek package for tracking long connections to report them before they have completed.
speytech/c-sentinelSemantic Observability for UNIX Systems - A lightweight C-based system prober with AI-powered analysis
