Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
shahdawadfallah-sys/cybersecurity-capstone-projectCybersecurity Capstone Project completed during the NCSC Nashama CyberCamp 11, delivered in collaboration with IT Security C&T. The project…
hybridbrothers/hunting-queries-detection-rulesThe purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious…
hxnoyd/ossem-power-upA tool to assess data quality, built on top of the awesome OSSEM.
manishrawat21/detection-rulesThis repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…
the-dfir-report/sigma-rulesRules generated from our investigations.
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
sarjanpatel22/siem-threat-detection-labBlue-team SIEM lab: Wazuh 4.7.5 detecting 7 simulated attacks (SSH brute force, Slowloris DoS / CVE-2007-6750, web attacks) with real-time MITRE…
alisha-chaudhary/ssh-enumThis project explores whether modern OpenSSH reveals valid usernames through subtle response or timing differences. CVE-2016-6210 user enumeration…
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
corelight/zeek-endpoint-enrichment
g0thamrabb1t/cve-2026-46331-pedit-cow-detectionDefensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.
corelight/extendintelThis package extends the Intel package to log more fields
trustedsec/sysmoncommunityguideTrustedSec Sysinternals Sysmon Community Guide
k3ystr0k3r/cve-2026-48907CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution (RCE)
owasp-modsecurity/modsecurityModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
