DetectionLab
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
configuration-auditingdefensive-toolsdigital-forensics+5
5.0k
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
neo23x0/signature-baseYARA signature and IOC database for my scanners and tools
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
barghest-ngo/meshEncrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…
kevin9480/security_incident_reportReact2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
jhatchi/nexacorp-dfir-inc-2026-001DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement…
security-onion-solutions/security-onionSecurity Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
olafhartong/sysmon-modularA repository of sysmon configuration modules
withsecurelabs/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.