awesome-threat-detection
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
curated-resourceseducationincident-response+7
4.7k
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
hslatman/awesome-industrial-control-system-securityA curated list of resources related to Industrial Control System (ICS) security.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
puniaze/portdogNetwork anomaly detector that monitors raw packets to identify port scanning activity in real time, with flexible sniffing duration controls and live…
rvazarkar/antipwnyA host based IDS written in C# Targetted at Metasploit
corelight/detect-ransomware-filenamesZeek script that monitors SMB traffic and alerts on known ransomware filenames using the Anti-Ransomware File System Resource Manager list.
yjesus/patriot-linuxHost IDS for desktop users
corelight/icanntldZeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…
freeguy-6/dmz-security-monitoring-hardeningCY376 Blue Team project — pfSense DMZ, Suricata IDS/IPS, and automated host hardening against CVE-2014-6271
mellow-hype/c2finderLook for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)
imthenachoman/how-to-secure-a-linux-serverStep-by-step guide for hardening a Linux server, covering SSH security, firewalls, intrusion detection, auditing, and system configuration to reduce…
telekom-security/tpotce🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
kismetwireless/kismetGithub mirror of official Kismet repository
neo23x0/auditdBest Practice Auditd Configuration
withsecurelabs/doublepulsar-detection-scriptA python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
duggytuxy/syswardenHost-local Linux security orchestrator enforcing nftables policy with HIDS/HIPS telemetry, bounded threat-intelligence feeds, out-of-band WAAP log…
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
cybermaggedon/cyberprobeCapturing, analysing and responding to cyber attacks