OshoosiClaw
oyesanyf/oshoosiclawAutonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping,…
ai-securityanomaly-detectioncommand-and-control+8
7
oyesanyf/oshoosiclawAutonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping,…
cognis-digital/c2detectC2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
alphasoc/flightsimA utility to safely generate malicious network traffic patterns and evaluate controls.
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
nccgroup/royal_aptRoyal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
joda32/got-respondedA simple tool to detect NBT-NS and LLMNR spoofing (and messing with them a bit)
corelight/zeek-netsupport-detectorA Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.
embee-research/yara-detection-rulesYara Rules for Modern Malware
offseckit/cve-2026-24207CVE-2026-24207 — NVIDIA Triton SageMaker auth bypass to unauth RCE. Detection script, bypass demo, RCE-chain PoC, and IDS rules.
immersive-labs-sec/bruteratel-detectiontoolsA collection of Tools and Rules for decoding Brute Ratel C4 badgers
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
shahidmallaofficial/cpanel-cve-2026-41940-fixOne-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and…
corelight/zeek-asyncrat-detectorA Zeek based AsyncRAT malware detector.