#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
benny-e/guarddML-Based behavioral endpoint detection system for Linux machines
nesg-ugr/msnm-sensorMultivariate statistical network monitoring sensor that detects anomalies using PCA-based techniques, aggregating lightweight statistics from…
corelight/cve-2021-1675Zeek script and Suricata rules to detect PrintNightmare (CVE-2021-1675) exploitation via RpcAddPrinterDriver DCE RPC events, with PCAP-based testing.
armadito/armadito-windows-driverWindows Driver for Armadito
honeylabshq/spip-goSpip network sensor written in Go
corelight/sigredZeek package for detecting CVE-2020-1350 (SIGRed) Windows DNS server exploit attempts via large DNS SIG/KEY response analysis with configurable…
corelight/zeek-spicy-ipsecA Zeek IPSec protocol analyzer based on Spicy.
mr-r3b00t/cve-2021-44228PowerShell-based backdoor detection tool for VMware Horizon connection servers, targeting CVE-2021-44228. Includes canary with optional submission…
letlaka/redsun-bluehammer-undefend-detection-packMicrosoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.
mustafadalga/arp-spoof-detectorBilgisayarınıza yapılan ARP Spoofing saldırılarını tespit eden ARP Spoof Detector Scripti.
corelight/corelight-ansible-rolesCorelight-Ansible-Roles are a collection of Ansible Roles and playbooks that install, configure, run and manage a variety of Corelight, Suricata and…
corelight/cve-2020-14882-weblogicrceDetection of RCE in Oracle's WebLogic Server CVE-2020-14882 / CVE-2020-14750
corelight/zerologonZeek package to detect Zerologon
corelight/top-dnsTop DNS Measurement for Bro
corelight/zeek-quicBro analyzer that detects Google's QUIC protocol
lucadibello/network-attack-detectionAdvanced detection of port scanning, DoS and malware attacks using Machine Learning techniques
corelight/pingbackA Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.
