Loki
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
anomaly-detectiondigital-forensicsdisk-forensics+11
3.8k
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
mckinnonit/zabbix-template-cve-2020-1472Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472. Monitors event…
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections
0x0v1/audixAudix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
withsecurelabs/doublepulsar-detection-scriptA python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
kitskater/legacyshield-cve-2017-0144Defensive Windows security application providing compensating controls for CVE-2017-0144 (EternalBlue/MS17-010) through SMB monitoring, attack…
ernestak/sigma-rule-for-cve-2022-30190Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
nate-ryan-7690/home_soc_suiteA personal Windows SOC suite built in PowerShell — monitors network connections, resource usage, scheduled tasks and power events with severity…
wattocyber/detection-defense-libraryDetection-engineering reference mapping Windows, cloud, container, identity, and ICS attack classes to Sigma rules, trust-boundary models, BYOVD…
benjeems/packetstriderA network packet forensics tool for SSH
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
kevin-robertson/conveighConveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool