Archived
BearFTP
kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
defensive-toolsincident-responseinformation-gathering+4
14
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
alloysecuregroup/phantomfsWindows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…
withsecurelabs/doublepulsar-detection-scriptA python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
sans-blue-team/deepbluecliPowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…
bruneaug/dshield-siemDShield Sensor Log Collection with ELK
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
withsecurelabs/lazarus-sigma-rulesSigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…
theflink/hunt-weird-syscallsETW based POC to identify direct and indirect syscalls
mthcht/purpleteamPurpleteam scripts simulation & Detection - trigger events for SOC detections
corelight/pingbackA Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
sigmahq/pysigma-backend-opensearchpySigma OpenSearch backend
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
corelight/cve-2022-30216Zeek package detecting CVE-2022-30216 NTLM relay attacks against Windows Server. Raises notices for exploit attempts and successful exploitation via…
mckinnonit/zabbix-template-cve-2020-1472Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472. Monitors event…
rajiv2790/falconeyeKernel-mode Windows driver for real-time detection of process injection techniques, including shellcode, DLL, and reflective injection, with syscall…
corelight/sigredZeek package for detecting CVE-2020-1350 (SIGRed) Windows DNS server exploit attempts via large DNS SIG/KEY response analysis with configurable…