
ja4
JA4+ is a suite of network fingerprinting standards

JA4+ is a suite of network fingerprinting standards

Real-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…

A process monitoring tool that tries to detect exploitation

Open-source detection engineering tool that traces security detections end to end and identifies the first failing stage.

Parse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…

A tool to assist with network-based hunting for GRU's Drovorub malware c2

Rust tool to detect cell site simulators on an orbic mobile hotspot

Monitors Asterisk authentication logs and automatically bans IPs with repeated failed login attempts using iptables, with configurable thresholds and…

Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…

RPi3+ Network Cracker Setup Tool

A tool to monitor local network traffic for possible security vulnerabilities. Warns user against possible nmap scans, Nikto scans, credentials sent…

File integrity monitoring tool that detects unauthorized changes to monitored files and directories using attribute checks, multiple hash algorithms,…

Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

A simple tool to detect NBT-NS and LLMNR spoofing (and messing with them a bit)

A real-time traffic monitoring tool that detects and displays network traffic volume per IP address to identify potential DDoS attacks.

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

NetworkAssessment: Network Compromise Assessment Tool