Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
kaleth4/cve-2026-64638Technical analysis and defensive mitigation for a WordPress Core pre-auth XSS-to-RCE chain, including sanitizer bypass, DOM clobbering, JSONP abuse,…
velessecurity/cve-2021-1675-printnightmare-analysisTechnical write-up and analysis of PrintNightmare (CVE-2021-1675 / CVE-2021-34527), covering RCE/LPE exploitation, detection via Windows event logs,…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
wattocyber/masqLive recon and posture auditing for AI agent infrastructure: scans MCP configs, session logs, and APIs for secrets, poisoned catalogs, and CoT leaks.
kevin9480/security_incident_reportReact2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트
theretardedelon/gpewebdefenderLightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
harshiys/cve-2007-2447-exploitation-siem-detection-labIsolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
glebusalt/cybersecurity_portfolioПрактические кейсы по информационной безопасности: развёртывание SIEM Wazuh и эксплуатация CVE-2021-41773
bruneaug/dshield-siemDShield Sensor Log Collection with ELK
beenuar/aisocOpen-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…
signalapp/key-transparency-auditorContinuously fetches and cryptographically verifies key transparency log updates, maintains a condensed prefix and log tree view, and returns signed…
phpboyscout/go/redactStrip credential-like content from free-form strings before they reach logs or telemetry. Part of the phpboyscout Go toolkit. ·…
c3rb3ru5d3d53c/signaturesCommunity Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
karitamw/printnightmare-detection-mitigation-labSanitised Windows security lab demonstrating Active Directory administration, host and network detection, and layered mitigation of CVE-2021-34527.
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
