
detections
Curated repository of detection information and validation guidance for identifying malicious activity in enterprise environments.

Curated repository of detection information and validation guidance for identifying malicious activity in enterprise environments.

MysqlHoneypot

Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research

Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…

Top DNS Measurement for Bro

A Zeek OpenVPN protocol analyzer plugin.

Chronicle parser for CORELIGHT and related information.

Integrates your Modern Honeypot Network Server and Wordpress Blog via MHN's REST API and WP's shortcodes

SigCorr is the first open-source tool to detect cross-protocol attack chains spanning SS7/MAP, Diameter S6a, and GTPv2-C through unified subscriber…

Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…

A Wordpress Honeypot

Honeynet Project generic authenticated datafeed protocol

My attempt to make honeypot for React2Shell vulnerability (CVE-2025-66478)

Tools for investigating Log4j CVE-2021-44228

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

Generates efficient IPv4 blocklists from Zeek network flows using multiple prioritization models (new, consistent, random forest) to identify…

System-independent library for user-level packet capture and filtering. Provides a portable framework for low-level network monitoring, security…

Data we are receiving from our honeypots about CVE-2021-44228