scripts
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
digital-forensicsforensicsincident-response+5
84
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
confused-binary/waf-fuTerminal UI for browsing and replaying AWS WAF v2 logs from CloudWatch, S3, and the sampling API, with YAML filtering, auth detection, and…
borsch-appreciator/soc235---atlassian-confluence-broken-access-control-0-day-cve-2023-22515SOC analyst walkthrough triaging a Confluence CVE-2023-22515 broken access control exploitation attempt, covering log analysis, MITRE ATT&CK mapping,…
hainhc/cve-2026-73570Proof-of-concept exploit for CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite via zimbra-snmp log injection,…
jithinkrishnanrs/cve-2026-67401-cpanel-emailtrack-sqliRead-only IOC scanner and mitigation toolkit for cPanel & WHM EmailTrack SQL injection (CVE-2026-67401). Performs version fingerprinting, file…
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
withsecurelabs/remotepspyLive monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…
withsecurelabs/esfangESF modular ingestion tool for development and research.
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
withsecurelabs/detectreeInteractive data visualization tool for blue teams to analyze detection data, understand relationships, reduce alert fatigue, and improve incident…
withsecurelabs/lazarus-sigma-rulesSigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…
withsecurelabs/macostriagecollectionscriptCollects comprehensive triage data from macOS for incident response, including system logs, file listings, browser data, shell history, and…
fireeye/pywintracePython ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…
nadineelliottcyber/soc335-cve-2024-49138-investigationSOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.
eshlomo1/microsoft-sentinel-secopsSOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
siberanka/rdp-guardMonitors Windows Security logs for failed RDP attempts and automatically blocks abusive IPs via Windows Firewall, with configurable thresholds and…
d3vhex/sentoraAn open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.