Log Analysis

michael-kanda/wp2shell-ioc-scanner

Detects shadow-administrator accounts in WordPress via configurable indicators and heuristics, then removes selected accounts through guarded, logged…

snorby/snorby

Ruby On Rails Application For Network Security Monitoring

batchmcnulty/malbait

Simple TCP/UDP honeypot implemented in Perl

nccgroup/burp-reflux

Burp proxy text log converter to CSV and SQLLite

nccgroup/impossibletravelloganalysis

Basic log analysis tool to detect impossible travel via IP address geographic information

nccgroup/liblapith

A really simple Nessus results library

nccgroup/loggerplusplus

Advanced Burp Suite Logging Extension

nccgroup/mimikatz-detector-busylight

USB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is executed, a…

nccgroup/mimikatz-detector-condrv

The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…

nccgroup/mortimer

A collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.

nccgroup/reactor

Runs custom filters on Elasticsearch and alerts on matches

nccgroup/windowsmempagedelta

A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection

rxerium/honeypot

🍯Honeypot Threat Intel

d0rb/packetpirate

A headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems.

synacktiv/forensic-msvpn

This repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity

santosomar/log4j-ioc-detector

A Simple Log4j Indicator of Compromise Linux Detector

knqyf263/ndff

A flow-based network monitor with Deep Packet Inspection