malware-iocs
doctorwebltd/malware-iocsCurated Indicators of Compromise (IOCs) from Doctor Web malware investigations, published for threat intelligence, detection engineering, and…
curated-resourcesforensicsincident-response+4
244
doctorwebltd/malware-iocsCurated Indicators of Compromise (IOCs) from Doctor Web malware investigations, published for threat intelligence, detection engineering, and…
jaksi/sshesameAn easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
sifalcon/detectionCurated collection of detection rules and IOCs extracted from DFIR engagements and malware analyses to support threat hunting, incident response, and…
certsocietegenerale/irmIncident Response Methodologies 2022
nccgroup/uninstalledappcanaryA Canary which fires when uninstalled
ry-allan/tanstack-compromise-checkerDetects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks…
swaybs/cve-2024-3400Python script to check Palo Alto firewalls for CVE-2024-3400 exploit attempts
ma1am/cve-2022-26134-exploit-detectionThis repository contains Yara rule and the method that a security investigator may want to use for CVE-2022-26134 threat hunting on their Linux…
securitytemplates/sectemplatesOpen source templates you can use to bootstrap your security programs
gamelinux/passivednsA network sniffer that logs all DNS server replies for use in a passive DNS setup
mkorman90/regipyRegipy is an os independent python library for parsing offline registry hives
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
anttikurittu/kirjuriKirjuri is a web application for managing cases and physical forensic evidence items.
netflix/security_monkeySecurity Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
cert-lv/exchange_webshell_detectionDetect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857,…