LOLDrivers
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
curated-resourceseducationforensics+5
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
pduggusa/dugganusa-ietfDugganUSA threat-intelligence contributions to the IETF Hackathon — real-world agentic-attack benchmark vectors, CVE-2026-33697 attestation analysis,…
anuththara2007-w/cve-2026-20127-exploit-extension
zedocun/sharepoint-toolshell-cve-2025-53770-incident-analysisTechnical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.
tarunbharathe/zero-click-rce-incident-response-cve-2025-21298Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware…
vignesh-hp/lockbit-ransomware-analysisThreat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.
bridg3ops/soc335-cve-2024-49138-exploitation-detected
cobalt-strike/sleep_python_bridgeThis project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need…
macuchegit/detecting-and-analyzing-cve-2024-24919-exploitation
qeeqbox/analyzerAnalyze, extract and visualize features, artifacts and IoCs of files and memory dumps (Windows, Linux, Android, iPhone, Blackberry, macOS binaries,…
ciscocsirt/gosintThe GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise (IOCs).