Intrusion Detection

orevic21/wazuh-home-soc

Wazuh + Suricata SOC lab detecting real exploits (CVE-2011-2523) and brute-force attacks, with custom detection rules for gaps in default IDS…

corelight/cve-2022-30216

Zeek package detecting CVE-2022-30216 NTLM relay attacks against Windows Server. Raises notices for exploit attempts and successful exploitation via…

eyesecurity/wp2shell-compromise-scanner-plugin

Read-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)

rauljvc8/cve-2025-68616-detecting-and-patching-an-ssrf-in-weasyprint-with-wazuh

Hands-on vulnerability management case study: how Wazuh flagged a real SSRF (CVE-2025-68616) in WeasyPrint, and how I reproduced and patched it.

t0tooro/cve-2025-24054-lab

Blue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy

trnguyen03/activemq-ids-ips-lab

IDS/IPS lab for detecting and preventing Apache ActiveMQ RCE (CVE-2023-46604) using GVM, Nmap, Snort, iptables, and UFW.

rohitmalik7/cve-2024-38063-detection-mitigation-system

End-to-end cybersecurity project demonstrating detection and mitigation of CVE-2024-38063 using IDS, host-based monitoring, and virtual lab attack…

sarjanpatel22/siem-threat-detection-lab

Blue-team SIEM lab: Wazuh 4.7.5 detecting 7 simulated attacks (SSH brute force, Slowloris DoS / CVE-2007-6750, web attacks) with real-time MITRE…

captanmoss/log4shell-sandbox-signature

Log4Shell(CVE-2021-45046) Sandbox Signature

zanks08/cve-2023-44487-demo

Demo for detection and mitigation of HTTP/2 Rapid Reset vulnerability (CVE-2023-44487)

infokom-ki/zimbra-cve-2026-73570-rules

Wazuh detection rules for CVE-2026-73570, an OS command injection in Zimbra Collaboration Suite, monitoring web access logs and zimbra.log for…

yangyang-research/whale-sentinel-services

The Whale Sentinel Services

pinaraltinok/log4shell-attack

Multi-Stage Attack Modeling and Detection of Log4Shell for CVE-2021-44228

aricooper/suricata-script

CVE-2020-16898 — “Bad Neighbor” (ICMPv6 RDNSS length parsing) — Suricata Lua Detection

pisut4152/sigma-rule-for-cve-2021-22005-scanning-activity

Sigma rule for detecting scanning activity targeting CVE-2021-22005, enabling threat detection and log-based intrusion analysis.

vaishnavucv/project-vuln-detection-n-mitigation_101

Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization…

corelight/zeek-spicy-facefish

A Zeek protocol analyzer for the Facefish rootkit, based on Spicy.