C2-detection-manjusaka
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
command-and-controlincident-responseintrusion-detection+3
6
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
corelight/redxorDetection of Linux Malware C2 RedXOR - demonstration
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
corelight/pingbackA Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.
shahidmallaofficial/cpanel-cve-2026-41940-fixOne-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and…
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
ares-sys/uefi_bootkit_softlandingFirst public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
limo57640-crypto/cpanel-cve-41940-detectorRead-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.
corelight/zeek-spicy-facefishA Zeek protocol analyzer for the Facefish rootkit, based on Spicy.
embee-research/yara-detection-rulesYara Rules for Modern Malware
corelight/zeek-agenttesla-detectorA Zeek based Agent Tesla malware C2 detector.
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
immersive-labs-sec/bruteratel-detectiontoolsA collection of Tools and Rules for decoding Brute Ratel C4 badgers
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
alwashali/detection-validationDetection rule validation
offseckit/cve-2026-24207CVE-2026-24207 — NVIDIA Triton SageMaker auth bypass to unauth RCE. Detection script, bypass demo, RCE-chain PoC, and IDS rules.