Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
yossisassi/zerologon-exploitation-checkquick'n'dirty automated checks for potential exploitation of CVE-2020-1472 (aka ZeroLogon), using leading artifects in determining an actual…
shanika04/apache_skywalkingCVE-2020-9483 OR CVE-2020-13921
shanika04/dashbuilderCVE-2016-4999
trinitor/netstat2neo4jcreate cypher create statements for neo4j out of netstat files from multiple machines
resery/cve-2019-17041
maikelnight/zerologonCheck for events that indicate non compatible devices -> CVE-2020-1472
mingchen-script/cve-2020-1472-visualizer
danielwep/cve-netscalerfilesystemcheckThis script checks the Citrix Netscaler if it has been compromised by CVE-2019-19781 attacks and collects all file system information
k4yt3x/defense-matrixExpress security essentials deployment for Linux Servers
corelight/conn-burstA Bro package to identify connections that are bursting (lots of data and transferring quickly).
nccgroup/windowsmempagedeltaA Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
mellow-hype/c2finderLook for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)
mckinnonit/zabbix-template-cve-2020-1472Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472. Monitors event…
f5devcentral/cve-2020-5902-ioc-bigip-checker
corelight/top-dnsTop DNS Measurement for Bro
cisagov/check-your-pulseThis utility can help determine if indicators of compromise (IOCs) exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510.
