Winshark
airbus-cert/winsharkA wireshark plugin to instrument ETW
packet-sniffing-analysisforensicsnetwork-security+1
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
airbus-cert/winsharkA wireshark plugin to instrument ETW
chrisandoryan/nethive-projectRestructured and Collaborated SIEM and CVSS Infrastructure. Presented at Blackhat Asia Arsenal 2020.
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
jangeisbauer/gundoggundog - guided hunting in Microsoft Defender
telekom-security/tpotce🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.
swimlane/soc-fakerA python package for use in generating fake data for SOC and security automation.
h21lab/tsharkvmtshark + ELK analytics virtual machine
jonrau1/electriceyeElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting…
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
threathunters-io/qlogETW-based Windows process creation logger that enriches events with file hashes, signatures, and parent process details, outputting to Windows…
tothi/ad-honeypot-autodeployDeploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically.
crowdsecurity/crowdsecOpen-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365