SSHintel
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
incident-responseintrusion-detectionlog-analysis+2
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
jithinkrishnanrs/stylesmuggler-ioc-toolkitStyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells,…
safeagent-beihang/clawguardEnterprise AI agent security toolkit providing pre-flight auditing, configuration hardening, runtime threat detection, and active defense against…
duggytuxy/syswardenHost-local Linux security orchestrator enforcing nftables policy with HIDS/HIPS telemetry, bounded threat-intelligence feeds, out-of-band WAAP log…
fox-it/spookyssl-pcapsPCAPs and Suricata signatures for detecting OpenSSL CVE-2022-3602 exploitation attempts, including malicious client/server traffic and legitimate…
jdinovo/spadeSPaT Attack Detection and Evaluation dataset
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
fankh/vulnerability-pocCVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security…
gmh5225/crowarmorLinux kernel security driver using LSM to harden the system, monitor and restore syscall table integrity, and protect CPU control registers against…
withsecurelabs/lazarus-sigma-rulesSigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…
elihiho/security-operations-labsThreat Modeling, IT-/OT-Segmentierung, Snort Detection und reproduzierbare Validierung eines Drupal-Detection-Profils.
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
infokom-ki/zimbra-cve-2026-73570-rulesWazuh detection rules for CVE-2026-73570, an OS command injection in Zimbra Collaboration Suite, monitoring web access logs and zimbra.log for…
d3vhex/sentoraAn open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.
vasyapokemon/cve-2026-31431Research and detection toolkit for Linux kernel LPE CVE-2026-31431, including exploit analysis, YARA rules, auditd/Falco detection, patching guide,…
rohithronanki/cve-2026-34159-vulnerability-research-analysis-detectionCritical buffer validation bypass in deserialize_tensor() (llama.cpp < b8492). Null tensor buffer skips bounds check, enabling unauthenticated…
mr-r3b00t/cve-2026-0300Deceptive honeypot designed to simulate and monitor exploitation attempts targeting CVE-2026-0300, capturing attacker behavior for analysis and…
mahdi13830510/cve-2026-31431-mitigation-suiteKernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift…