googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
thingsboard/thingsboardOpen-source IoT Platform - Device management, data collection, processing and visualization.
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
mukendi/kratosminifilterKratos is a high-performance Windows File System Minifilter driver designed to detect, block, and permanently immunize
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
aquibpro/forensix-studioForensic intelligence platform that analyzes files, correlates threat indicators, maps behavior to MITRE ATT&CK, and generates actionable security…
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
reprise99/sentinel-queriesCollection of KQL queries
corelight/zeek-long-connectionsZeek package for tracking long connections to report them before they have completed.
salesforce/hasshHASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…
corelight/hasshFingerprint SSH clients and servers.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
nccgroup/reactorRuns custom filters on Elasticsearch and alerts on matches
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
