awesome-dfir-skills
tsale/awesome-dfir-skillsA curated collection of DFIR skills and workflows for InfoSec practitioners.
ioc-managementmemory-forensicsnetwork-forensics+7
321
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
tsale/awesome-dfir-skillsA curated collection of DFIR skills and workflows for InfoSec practitioners.
corelight/zeek-spicy-openvpnA Zeek OpenVPN protocol analyzer, based on Spicy.
blevene/bandjacksCyber Threat Defense World Modeling
rnb-team/loghoundPost-Exploitation EVTX Analyzer for BloodHound Mapping
pedrofbrm/apache-web-log-analysis-labBlue Team lab focused on analyzing Apache web access logs to detect directory brute forcing and web scanning activity.
hasecuritysolutions/vulnwhispererCreate actionable data from your Vulnerability Scans
karmanyat28/multi-stage-exploitation-and-detection-engineering-analysis-of-cve-2023-34362-in-moveit-transferThis repository contains an academic and technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting the MOVEit Transfer…
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
neo23x0/auditdBest Practice Auditd Configuration
orgito1015/cve-2025-55182-researching-process
trnguyen03/activemq-ids-ips-labIDS/IPS lab for detecting and preventing Apache ActiveMQ RCE (CVE-2023-46604) using GVM, Nmap, Snort, iptables, and UFW.
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
signalapp/key-transparency-auditorContinuously fetches and cryptographically verifies key transparency log updates, maintains a condensed prefix and log tree view, and returns signed…
navya240/intel471-threat-hunting-cve-2023-46604My first hands-on Intel 471 threat hunting workshop experience investigating CVE-2023-46604 using Elastic SIEM, vulnerability intelligence, and…
b4ntgrim/vuln_remediation_megaquaggaRemediation report for MegaQuagga Publishing validating the mitigation of CVE-2019-9978 through progressive defensive layering. Documents reverse…
formerlab/shadow-fleet-tracker-lightOpen source Baltic Sea shadow fleet tracker. 1200+ vessels, live AIS, cable proximity alerts. No cloud, no subscription, runs locally
ivoalbacete/kali-metasploitableEscaneo de vulnerabilidades, análisis de tráfico con Wireshark y explotación controlada del CVE-2011-2523 (vsftpd 2.3.4) en entorno de red segura.
tieupham267/log4shell-corazaLog4Shell (CVE-2021-44228) defense lab — nginx + Coraza WAF dynamic module + OWASP CRS v4. Educational use only.