Security lists for SOC/DFIR detections

🐾 Threat Hunting:

• ThreatHunting keywords Site
• ThreatHunting keywords Lists
• ThreatHunting Yara rules

ThreatHunting searches

• Windows Services Searches
• User-Agents Searches
• DNS Over HTTPS Searches
• Suspicious TLDs Searches
• HijackLibs Searches
• Phishing & DNSTWIST Searches
• Browsers extensions Searches
• C2 hiding in plain sigh
• HTML Smuggling artifacts
• PSEXEC & similar tools Searches
• Time Slipping detection
• Suspicious Named pipes

📂 My Detection Lists

• 📋 Lists: https://github.com/mthcht/awesome-lists/tree/main/Lists
• 🕵️‍♂️ ThreatHunting Guides: https://mthcht.medium.com/list/threat-hunting-708624e9266f
• 🚰 Suspicious Named pipes: suspicious_named_pipe_list.csv
• 🌐 Suspicious TLDs (updated automatically): [suspicious_TLDs]
• 🌐 Suspicious ASNs (updated automatically): [suspicious ASNs]
• 🌐 FYI Maxmind GeoIP Database (updated automatically): GeoIP DB
• 🆔 Oauth suspicious App IDs: OauthSentry
• 🔧 Suspicious Windows Services: suspicious_windows_services_names_list.csv
• ⏲️ Suspicious Windows Tasks: suspicious_windows_tasks_list.csv
• 🚪 Suspicious destination port: suspicious_ports_list.csv
• 🛡️ Suspicious Firewall rules: suspicious_windows_firewall_rules_list.csv
• 🆔 Suspicious User-agent: suspicious_http_user_agents_list.csv
• 🔏 Suspicious CERTs signer: [suspicious CERTS]
• 📇 Suspicious USB Ids: suspicious_usb_ids_list.csv
• 🏷️ Suspicious mutex names: suspicious_mutex_names_list.csv
• 🔢 Suspicious MAC address: suspicious_mac_address_list.csv
• 📛 Suspicious Hostname: suspicious_hostnames_list.csv
• 🌐 Suspicious Browser Extensions: Browser Extensions
• 📧 Microsoft App IDs List - BEC Detection microsoft_apps_list.csv
• 🧮 Metadata Executables: executables_metadata_informations_list.csv
• 🕸️ DNS over HTTPS server list: dns_over_https_servers_list.csv
• 🕸️ Dynamic DNS domains list: dyndns_list.csv
• 🪝 Phishing lists: Phishing domains and urls
• 🕸️ Domains : [sinkholed servers]
• 🕳️ Sinkholed Domains : sinkholed_domains.csv
• 🕳️ Sinkholed Site: SINKHOLED
• 📚 Hijacklibs (updated automatically): hijacklibs_list.csv
• 🌐 TOR Nodes Lists (updated automatically): [TOR]
• 🛠️ LOLDriver List (updated automatically): loldrivers_only_hashes_list.csv
• 🛠️ Malicious Bootloader List (updated automatically): malicious_bootloaders_only_hashes_list.csv
• 📜 Malicious SSL Certificates List (updated automatically): ssl_certificates_malicious_list.csv
• 🖥️ RMM detection: [RMM]
• 👤🔑 Important Roles, groups and permissions for AD/EntraID/AWS/Graph: [permissions]
• 💻🔒 Ransomware known file extensions: ransomware_extensions_list.csv
• 💻🔒 Ransomware known file name ransom notes: ransomware_notes_list.csv
• 📝 Windows ASR rules: windows_asr_rules.csv
• 🌐 DNSTWIST Lists (updated automatically): DNSTWIST Default Domains + script
• 🌍 VPN IP address Lists (updated automatically):
  • 🛡️ NordVPN: nordvpn_ips_list.csv
  • 🛡️ ProtonVPN: protonvpn_ip_list.csv
  • 🛡️ SurfShark: surfshark_vpn_servers_domains_and_ips_list.csv
  • 🛡️ MullVad: mullvad_relay_servers_ips_list.csv