wattocyber/detection-defense-libraryDetection-engineering reference mapping Windows, cloud, container, identity, and ICS attack classes to Sigma rules, trust-boundary models, BYOVD…
hackspeak/cve-2026-23479Redis UAF RCE PoC collection for CVE-2026-23479: safe version checker, exploit module, GDB-assisted PoC, and Sigma detection rules for authorized…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
theretardedelon/gpewebdefenderLightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.
harshiys/cve-2007-2447-exploitation-siem-detection-labIsolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
bruneaug/dshield-siemDShield Sensor Log Collection with ELK
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
neo23x0/raccineA Simple Ransomware Vaccine
codextf2/cobaltstrike-sleepmask-yaraJust a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-…
gendigitalinc/iocThreat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.
rfxn/linux-malware-detectMulti-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring,…
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
chainguard-dev/osquery-defense-kitProduction-ready detection & response queries for osquery
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
connectedlucy/plagueDefault Detections for EDR
