LOLRMM
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
curated-resourcesdefensive-toolseducation+6
396
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
kalidoulabghaly/log4shell-exploitation-detectionHands-on project demonstrating Log4Shell exploitation, detection engineering with Splunk and auditd, and validated remediation in a containerized…
nadineelliottcyber/soc335-cve-2024-49138-investigationSOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.
zhoucc-cpu/cve-2023-23397-detection-labDetection and mitigation research lab for CVE-2023-23397 using network and endpoint security telemetry.
the-dfir-report/sigma-rulesRules generated from our investigations.
malgamy/yara_rulesCurated signature-rule collection for detecting and classifying malicious files via pattern matching, with CLI instructions for scanning files and…
defenders-guide/thedefendersguideThe Github project for The Defender's Guide by Luke Paine and Jonathan Johnson
theflink/hunt-weird-imageloadsSmall tool to play with IOCs caused by Imageload events
joertx07/printnightmare-detection-labSplunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…
nabhan-mohy/dirty-frag-research-cve-2026-43284-Comprehensive technical research on CVE-2026-43284 (Dirty Frag), including Linux kernel internals, root cause analysis, patch analysis, detection…
nccgroup/reactorRuns custom filters on Elasticsearch and alerts on matches
nccgroup/yaml2yaraGenerate bulk YARA rules from YAML input
owasp/honeypot-projectDeploy web honeypots to capture emerging attack data, analyze ModSecurity audit logs via ELK, and share threat intelligence with MISP for…
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
iomoath/filewatchtowerFWT is a security analysis and file monitoring tool that utilizes Sysmon events.
salo-404/firewall🔒 Spring4Shell Firewall Defense — Cybersecurity Incident Simulation This project is part of a Cybersecurity Job Simulation I completed in August…
vaishnavucv/project-vuln-detection-n-mitigation_101Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization…
karmanyat28/multi-stage-exploitation-and-detection-engineering-analysis-of-cve-2023-34362-in-moveit-transferThis repository contains an academic and technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting the MOVEit Transfer…