joy
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
anomaly-detectiondigital-forensicsdns-analysis+7
1.4k
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
owasp/aisvsThe AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…
endgameinc/dga_predictLSTM-based classifier for detecting domain generation algorithm (DGA) domains, with Keras implementations of neural network and bigram models for DNS…
ang13t/dronextractDigital forensics suite for DJI drones that parses telemetry files, extracts hidden data via steganography, visualizes flight paths, and detects…
antropos17/aegisOS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent…
theflink/hunt-weird-syscallsETW based POC to identify direct and indirect syscalls
puniaze/portdogNetwork anomaly detector that monitors raw packets to identify port scanning activity in real time, with flexible sniffing duration controls and live…
jonrau1/syntheticsunServerless AWS security automation framework that ingests threat intelligence, applies ML-based anomaly detection (RCF, IP Insights), and enriches…
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
nameles-org/namelesOpen source entropy based invalid traffic detection and pre-bid filtering.
agentguard-ai/tealtigerPowerful protection for AI agents - Open-source security and cost tracking for AI applications
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
0xe7/wonkavisionDetects forged Kerberos tickets by dumping session and ticket data, scoring anomalies, and generating Windows event-log indicators for SIEM-based…