ARTIF
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.
information-gatheringintrusion-detectionioc-management+5
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.
scythe-io/purple-team-exercise-frameworkPurple Team Exercise Framework
corelight/icanntldZeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
nerium-security/cve-2025-55182Host-based detection rules for the RCE vulnerability in the React JavaScript framework.
cognis-digital/c2detectC2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
cr0nx/awesome-linux-attack-forensics-purplelabsThis page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
mushorg/buttinskyBotnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
linux-audit/audit-kernelGitHub mirror of the Linux Kernel's audit repository
paolokappa/sharepointsecuritymonitorA comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2025-53770 protection, advanced DLL analysis, threat detection, and…
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
corelight/threat-hunting-guideStructured guide to threat hunting using Zeek logs, aligned with MITRE ATT&CK framework for proactive detection of adversary tactics and techniques.
azdevops143/fragnesia-charan-cve-2026-46300Hardened container staging framework with seccomp syscall whitelisting and eBPF telemetry to detect and block container escape and kernel ULP…
aide/aideFile integrity monitoring tool that detects unauthorized changes to monitored files and directories using attribute checks, multiple hash algorithms,…
ma111e/melodyMelody is a transparent internet sensor built for threat intelligence. Supports custom tagging rules and vulnerable application simulation.