Tools

arkime/arkime

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

olafhartong/sysmon-modular

A repository of sysmon configuration modules

spectralzero/netscope

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

rabobank-cdc/dettect

Detect Tactics, Techniques & Combat Threats

honeylabshq/spip-go

Spip network sensor written in Go

ares-sys/uefi_bootkit_softlanding

First public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…

corelight/ecs-logstash-mappings

Mapping Corelight or Zeek data to Elastic Common Schema logs

eyesecurity/wp2shell-compromise-scanner-plugin

Read-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)

te0rwx/cve-2025-32433-detection

Custom YARA rule for detecting artifacts of CVE-2025-32433, an Erlang/OTP SSH pre-authentication RCE vulnerability. Validated against public PoCs and…

backbay-labs/thrunt-god

Threat hunting command system for agentic IDEs

activecm/rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

gendigitalinc/ioc

A continuously updated collection of threat intelligence indicators of compromise (IOCs), including YARA rules, for detecting and tracking malware…

certtools/intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

pinaraltinok/log4shell-attack

Multi-Stage Attack Modeling and Detection of Log4Shell for CVE-2021-44228

bartblaze/yara-rules

Collection of private Yara rules.

logisek/baconsampler

Sniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.

nextronsystems/sysmon-config

Provides curated Sysmon event-tracing configuration templates for detecting Cobalt Strike, webshells, ransomware artifacts, and known exploit…