MISP
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
curated-resourcesdatabase-securitydefensive-tools+10
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
zoneminder/zoneminderZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.
ntop/ndpiOpen Source Deep Packet Inspection Software Toolkit
wecooperate/imonitorEndpoint behavior monitoring and analysis system for processes, files, registry, and networks. Supports scripting, extensions, and plugins for…
rajiv2790/falconeyeKernel-mode Windows driver for real-time detection of process injection techniques, including shellcode, DLL, and reflective injection, with syscall…
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.
corelight/raspi-corelightCorelight@Home script
elastic/protections-artifactsElastic Security detection content for Endpoint
withsecurelabs/doublepulsar-detection-scriptA python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
dinotools/dionaeaLow-interaction honeypot that emulates vulnerable network services to capture malware, shellcode, and exploit attempts, with IPv6 and TLS support.
theflink/hunt-weird-syscallsETW based POC to identify direct and indirect syscalls
delivr-to/detectionsA home for detection content developed by the delivr.to team
rvazarkar/antipwnyA host based IDS written in C# Targetted at Metasploit
corelight/detect-ransomware-filenamesZeek script that monitors SMB traffic and alerts on known ransomware filenames using the Anti-Ransomware File System Resource Manager list.
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
nccgroup/yaml2yaraGenerate bulk YARA rules from YAML input