DeTTECT
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
defensive-toolsscada-ics-securitymobile-security+4
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
m4nbat/100_days_of_kql_2026A repo to hold KQL queries as part of my 100 days of KQL effort.
honeylabshq/spip-goSpip network sensor written in Go
pranshuchittora/simvynUniversal mobile devtool for Agents & Humans - control iOS Simulators, Android Emulators, and real devices from a single dashboard and CLI
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
cisco-talos/deceiveDECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!
joertx07/printnightmare-detection-labSplunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…
withsecurelabs/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
telekom-security/tpotce🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
karitamw/printnightmare-detection-mitigation-labSanitised Windows security lab demonstrating Active Directory administration, host and network detection, and layered mitigation of CVE-2021-34527.
michael-kanda/wp2shell-ioc-scannerDetects shadow-administrator accounts in WordPress via configurable indicators and heuristics, then removes selected accounts through guarded, logged…
freeguy-6/dmz-security-monitoring-hardeningCY376 Blue Team project — pfSense DMZ, Suricata IDS/IPS, and automated host hardening against CVE-2014-6271
tracehound/tracehoundOperational security controls with forensic guarantees
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
yamato-security/welaAudits Windows event log settings against best-practice guidelines and Sigma-rule detectability, with automated configuration for DFIR readiness.