Archived
BearFTP
kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
defensive-toolsinformation-gatheringnetwork-security+4
14
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.
pathtofile/sealighterETW and WPP tracing tool for security research. Subscribes to multiple providers, auto-parses events to JSON, and supports advanced filtering,…
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
orlikoski/skadiCollect, Process, and Hunt with host based data from MacOS, Windows, and Linux
rjsudlow/proxynotshell-ioc-checkerScript to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)
snovvcrash/usbripTracking history of USB events on GNU/Linux
evergreencartoons/senselessviolenceCVE-2022-31814 Exploitation Toolkit.
tothi/ad-honeypot-autodeployDeploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically.
nccgroup/mimikatz-detector-busylightUSB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is executed, a…
nccgroup/mimikatz-detector-condrvThe Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…
corelight/zeek2esA Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further…
romaissaadjailia/get-applockereventlogThis is a repo for fetching Applocker event log by parsing the win-event log
cyb3r-monk/rita-jImplementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
threathunters-io/qlogETW-based Windows process creation logger that enriches events with file hashes, signatures, and parent process details, outputting to Windows…