Learning-to-Detect
shuangliangx/learning-to-detectDetects unknown jailbreak attacks in large vision-language models using hidden state analysis and autoencoders, with training and evaluation…
ai-securityanomaly-detectiondefensive-tools+2
1
shuangliangx/learning-to-detectDetects unknown jailbreak attacks in large vision-language models using hidden state analysis and autoencoders, with training and evaluation…
gpt-laboratory/trustworthyragAn Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Retrieval-Augmented Generation Systems.
rob-med/awesome-ts-anomaly-detectionList of tools & datasets for anomaly detection on time-series data.
blue-yonder/tsfreshAutomatic extraction of relevant features from time series:
googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
yingtaoren/d-scanAnalyzes LLM internal states and 100+ attention/probability features to train classifiers that detect document poisoning attacks in RAG systems.
reprise99/sentinel-queriesCollection of KQL queries
cyb3r-monk/rita-jImplementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
1-bit-wonder/kestrelSingle-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
nccgroup/impossibletravelloganalysisBasic log analysis tool to detect impossible travel via IP address geographic information
nccgroup/reactorRuns custom filters on Elasticsearch and alerts on matches
corelight/conn-burstA Bro package to identify connections that are bursting (lots of data and transferring quickly).
corelight/http-stalling-detectorDetect HTTP stalling attacks like slowloris with Bro