Tools

efforg/rayhunter

Rust tool to detect cell site simulators on an orbic mobile hotspot

osbornepro/btps-secpack

PowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…

owasp/honeypot-project

Deploy web honeypots to capture emerging attack data, analyze ModSecurity audit logs via ELK, and share threat intelligence with MISP for…

alloysecuregroup/phantomfs

Windows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…

harshiys/cve-2007-2447-exploitation-siem-detection-lab

Isolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)

joertx07/printnightmare-detection-lab

Splunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…

sana-404/cve-2026-8838-mitigation-and-detection

Detection and mitigation scripts for CVE-2026-8838, providing vulnerability scanning, configuration auditing, and incident response guidance to…

the-dfir-report/sigma-rules

Rules generated from our investigations.

v3ng4mxv1p3r/mobile-drop-device-soc-detection

End-to-end simulation of detecting a root-less Android Drop Device (Casper) using Wazuh SIEM to capture Layer 7 attacks like Shellshock…

themoonsir/watcher

Detection reverse shell and kill it before trying shell.

hackura/xz-cve-2024-3094

Python demo simulating CVE-2024-3094: a supply chain backdoor in XZ Utils with a trigger-based stealth activation.

nosie12/fire-wall-server

Python-based simulated firewall to detect and block Spring4Shell (CVE-2022-22965) exploit attempts. This project filters HTTP requests by identifying…

tranqtruong/detect-bluekeep

a simple tool to detect the exploitation of BlueKeep vulnerability (CVE-2019-0708)

zanks08/cve-2023-44487-demo

Demo for detection and mitigation of HTTP/2 Rapid Reset vulnerability (CVE-2023-44487)

op7ic/blueteam.lab

Blue Team detection lab created with Terraform and Ansible in Azure.

gui774ume/krie

Linux Kernel Runtime Integrity with eBPF

lucadibello/network-attack-detection

Advanced detection of port scanning, DoS and malware attacks using Machine Learning techniques

theflink/hunt-weird-imageloads

Small tool to play with IOCs caused by Imageload events