
ioc2rpz
ioc2rpz is a place where threat intelligence meets DNS.

ioc2rpz is a place where threat intelligence meets DNS.


Detect and log CVE-2019-19781 scan and exploitation attempts.

A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

Security proxy for AI agents. Scans every message for prompt injection, PII, and secrets. Defense-in-depth: Go proxy + iptables firewall + eBPF…

KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of…

PowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…

Tools for investigating Log4j CVE-2021-44228

A script to configure a TP-Link MR3040 running OpenWRT into a simple, yet powerful penetration-testing "dropbox".

This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources…

Default Detections for EDR

Yara Rules for Modern Malware

Primary data pipelines for intrusion detection, security analytics and threat hunting

NetworkAssessment: Network Compromise Assessment Tool

A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.

PoC and Detection for CVE-2024-21626

tshark + ELK analytics virtual machine

A tool to generate Snort rules based on public IP reputation data