mrezqi/cve-2021-1675_carbonblack_huntingqueryCarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.
bridg3ops/soc335-cve-2024-49138-exploitation-detectedDetailed incident response walkthrough analyzing CVE-2024-49138 exploitation on Windows, covering process tree analysis, IOC identification, and…
ajtech-hue/cve-2021-3156-mitigation-shellscript-buildShell script that monitors for a vulnerable sudo process and triggers authentication lockout to mitigate CVE-2021-3156.
simonis/log4jpatchDeploys an agent to fix CVE-2021-44228 (Log4j RCE vulnerability) in a running JVM process
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
corretto/hotpatch-for-apache-log4j2An agent to hotpatch the log4j RCE from CVE-2021-44228.
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
loresuso/pscthe ps utility, with an eBPF twist and container context
santhreal/keyhogOpen-source secret scanner in Rust
emrekybs/douglas-042Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…
nccgroup/killedprocesscanaryA canary designed to minimize the impact from certain Ransomware actors
0xv1n/macnoiseExtensible MacOS system telemetry generator.
scoubi/bloodsocerAggregates MITRE ATT&CK, Sigma, and Atomic Red Team data into BloodHound graphs so SOC analysts can map detection coverage, identify gaps, and…
hackinglz/gibsonNetwork monitoring tool that maps process-to-network connections, identifies cloud providers, and detects beaconing activity
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
ebwi11/agentsmith-hidsBy Kprobe technology Open Source Host-based Intrusion Detection System(HIDS), from E_Bwill.
nbulischeck/tytonKernel-Mode Rootkit Hunter
