Tools

mvlnetdev/cve-2021-31166-detection-rules

Different rules to detect if CVE-2021-31166 is being exploited

corelight/zeek-strrat-detector

A Zeek based STRRAT malware detector.

corelight/zeek-agenttesla-detector

A Zeek based Agent Tesla malware C2 detector.

corelight/zeek-gozi-detector

A Zeek based Gozi banking malware detector.

initconf/cve-2020-16898-bad-neighbor

Zeek detection for CVE-2020-16898-"Bad Neighbor"

kimobu/cve-2021-44228

Some files for red team/blue team investigations into CVE-2021-44228

esnet-security/cve-2020-16898

Detects CVE-2020-16898: "Bad Neighbor"

below0day/honeypot-logs-cve-2025-5777

CitrixBleed 2 NetScaler honeypot logs

ntop/ntopng

Web-based Traffic and Cybersecurity Network Traffic Monitoring

owasp-modsecurity/modsecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…

zoneminder/zoneminder

ZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.

ossec/ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

thinkst/canarytokens

Canarytokens helps track activity and actions on your network

baidu/openrasp

Runtime application self-protection engine that hooks into application servers to monitor and block malicious database queries, file operations, and…

rfxn/linux-malware-detect

Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring,…

gossithedog/threathunting

Hunts for potential malware downloads and suspicious domain calls via common Windows LOLBins using YARA rules and Nexthink telemetry modules.

volexity/threat-intel

Signatures and IoCs from public Volexity blog posts.