psa-2026-00043-recovery
disqualifier/psa-2026-00043-recoveryRecovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)
cloud-infrastructure-securitydata-recoverydigital-forensics+3
disqualifier/psa-2026-00043-recoveryRecovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)
jwa7470/cve-2026-20131-post-incident-written-reportPost-incident report on CVE-2026-20131 (CVSS 10.0), a Cisco FMC insecure deserialization vulnerability exploited by Interlock ransomware. Details…
habibkaratas/sorry-ransomware-analysisSorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign
kevin9480/security_incident_reportReact2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트
threatlabz/toolsTools developed by the Zscaler ThreatLabz Threat Intelligence team
fabrimagic72/malware-samplesA collection of malware samples caught by several honeypots i manage
nccgroup/killedprocesscanaryA canary designed to minimize the impact from certain Ransomware actors
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
vignesh-hp/lockbit-ransomware-analysisThreat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).
limo57640-crypto/cpanel-cve-41940-detectorRead-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
mkdemir/activemq-lockbit-analysisApache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon…
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
anjai7/tryhack3m-bricks-heistTryHackMe CTF writeup — WordPress RCE via CVE-2024-25600, crypto miner forensics, and LockBit ransomware group identification
bedrock-safeguard/gentlemen-decryptorFirst-ever decryptor for The Gentlemen ransomware — recovers encryption keys from process memory dumps using X25519 ephemeral key extraction. 35/35…
crocodyli/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
concinnity-risks/ransomcoinpublicA DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
cado-security/dfir_resources_revil_kaseyaResources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack