
latma
Collects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…

Collects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…


Collection of KQL queries

Open source entropy based invalid traffic detection and pre-bid filtering.

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

IOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…

List of tools & datasets for anomaly detection on time-series data.

Detect HTTP stalling attacks like slowloris with Bro

Autoencoder-based anomaly detection for identifying phishing domains using CERT Polska warning list data, with Jupyter notebooks for research and…

My experiments in weaponizing ONOS applications (https://github.com/opennetworkinglab/onos)

A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.

Code, derived data and results for: Evaluating Baseline Detectors of Hijacked LLM Agents Under Rare Attacks and Distribution Shift

In-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Multivariate statistical network monitoring sensor that detects anomalies using PCA-based techniques, aggregating lightweight statistics from…

Graph-based threat detection system using inexact graph vector matching to compare threat graphs with CTI-derived attack query graphs for automated…

Response Overview Extension for BurpSuite - Find exotic responses by grouping response bodies

Analysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)