dshield
dshield-isc/dshieldInstalls and configures a DShield honeypot sensor on Raspberry Pi or Ubuntu, running Cowrie SSH and HTTP honeypots and forwarding firewall logs to…
defensive-toolsincident-responseinformation-gathering+5
536
dshield-isc/dshieldInstalls and configures a DShield honeypot sensor on Raspberry Pi or Ubuntu, running Cowrie SSH and HTTP honeypots and forwarding firewall logs to…
0xajstrike/opcuatrapHigh-interaction OPC UA honeypot for ICS/SCADA — multi-profile (oil & gas, water, power grid), live process simulation, per-session threat scoring,…
gitlab-security-oss/tldrSigma-based detection rules, log queries, atomic tests, and response procedures for monitoring and threat hunting in GitLab environments.
jaksi/sshesameAn easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
trustedsec/artilleryOpen-source blue team tool that protects Linux and Windows systems using multiple host and network defense and detection methods.
gopasteverything/gpewebdefenderLightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.
devinblack001/ddos-reduction-systemAdaptive two-stage Layer 4 DDoS mitigation gateway using behavioral traffic analysis, Random Forest classification, and kernel-level ipset/iptables…
thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…
kadir/copy-fail-cve-2026-31431-iocDetection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
immersive-labs-sec/bruteratel-detectiontoolsA collection of Tools and Rules for decoding Brute Ratel C4 badgers
olafhartong/sysmon-modularA repository of sysmon configuration modules
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
bartblaze/yara-rulesCollection of private Yara rules.
sifalcon/detectionCurated collection of detection rules and IOCs extracted from DFIR engagements and malware analyses to support threat hunting, incident response, and…
embee-research/sigmaA repository to release detection rules to the public
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon