#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
offseckit/cve-2026-24207CVE-2026-24207 — NVIDIA Triton SageMaker auth bypass to unauth RCE. Detection script, bypass demo, RCE-chain PoC, and IDS rules.
ptd200110/cve-2024-27198-soc-labSOC detection and incident response lab simulating CVE-2024-27198 authentication bypass in JetBrains TeamCity. Includes ELK SIEM, Suricata IDS, Sigma…
kouf320/docker-lab-cve-2017-5638-cve-2021-41773Docker-based multi-stage attack emulation lab demonstrating CVE-2017-5638 and CVE-2021-41773 exploitation, lateral movement, and Suricata IDS…
corelight/cve-2022-22954Zeek package that detects CVE-2022-22954 exploit attempts, logs exploit URIs and attacker response data to aid in incident response and network…
corelight/cve-2021-41773Zeek package detecting Apache HTTP Server path traversal/RCE exploits (CVE-2021-41773, CVE-2021-42013) with payload capture and server header…
corelight/zeek-strrat-detectorA Zeek based STRRAT malware detector.
zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitationIncident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check…
corelight/zeek-agenttesla-detectorA Zeek based Agent Tesla malware C2 detector.
hackspeak/cve-2026-23479Redis UAF RCE PoC collection for CVE-2026-23479: safe version checker, exploit module, GDB-assisted PoC, and Sigma detection rules for authorized…
corelight/zeek-caldera-detectorA Zeek based Mitre Caldera detector.
cucadili/cve-2017-3066Analysis and exploitation of CVE-2017-3066, a Java deserialization RCE in Adobe ColdFusion's BlazeDS library, with Suricata detection rules and…
freeguy-6/dmz-security-monitoring-hardeningCY376 Blue Team project — pfSense DMZ, Suricata IDS/IPS, and automated host hardening against CVE-2014-6271
corelight/zeek-asyncrat-detectorA Zeek based AsyncRAT malware detector.
thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…
mr-r3b00t/cve-2026-0300Deceptive honeypot designed to simulate and monitor exploitation attempts targeting CVE-2026-0300, capturing attacker behavior for analysis and…
corelight/zeek-gozi-detectorA Zeek based Gozi banking malware detector.
devopstoday11/tarianAnti-Virus for K8s. Protect your Applications running on Kubernetes from malicious attacks with pre-registered source code, runtime processes…
initconf/cve-2020-16898-bad-neighborZeek detection for CVE-2020-16898-"Bad Neighbor"
