MalDec-EDR
gmh5225/maldec-edrUnix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.
anomaly-detectiondefensive-toolsforensics+5
gmh5225/maldec-edrUnix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.
withsecurelabs/lazarus-sigma-rulesSigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…
mr-r3b00t/cve-2026-0300Deceptive honeypot designed to simulate and monitor exploitation attempts targeting CVE-2026-0300, capturing attacker behavior for analysis and…
thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…
c3rb3ru5d3d53c/signaturesCommunity Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma
srlabs/certiceptionAn ADCS honeypot to catch attackers in your internal network.
0warn/defenderThis is a bash script focus on hardening linux. This is a custom think of windows defender but unlike of their privacy issue. User can feel freedom…
andreicscs/honeywireOpen-source deception platform that turns any Linux machine into a high-signal canary. Deploy tripwire sensors on files, ports, and network services…
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
mandiant/vcsa-hardening-toolAutomated Zero Trust hardening and forensic auditing for VMware vCenter Server Appliance (VCSA)
neo23x0/auditdBest Practice Auditd Configuration
itzmeshervin/siem-dashboardA lightweight, real-time Security Information and Event Management (SIEM) dashboard built using Streamlit. It collects system logs, detects USB and…
khoinp1012/kprotectKernel-level security engine using eBPF-LSM to enforce file access policies based on process lineage, protecting sensitive data from supply-chain…
nsol-nmsu/fml-networkFLNET2023 is a dataset designed for intrusion detection in Federated Learning scenarios. It's built using the CORE emulator, simulating a realistic…
0x4d31/galahGalah: An LLM-powered web honeypot.
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
teler-sh/teler-wafteler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets,…
halildeniz/networkassessmentNetworkAssessment: Network Compromise Assessment Tool