bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
fhightower/ioc-finderSimple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related…
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
r3mrum/loki-parseA python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…
nccgroup/mortimerA collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.
honeylabshq/spip-goSpip network sensor written in Go
cloudflare/exim-cve-2019-10149-dataCurated dataset of IPs, ASNs, and SMTP banners for Exim CVE-2019-10149, with linked advisories and threat actor intelligence for vulnerability…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
ahmed-tarek22752/rce-cve-2017-0199-detection-analysisThis repository contains a full blue-team malware analysis of a real malicious DOCX exploiting CVE-2017-0199. The lab includes sandbox execution,…
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
corelight/zeek-cve-enrichmentZeek script and Python utility to enrich network security monitoring logs with CVE identifiers for improved threat intelligence and vulnerability…
dominic471/qub-network-security-cve-2023-20198Analysis, detection, and mitigation of CVE-2023-20198 exploitation in Cisco IOS XE – QUB CSC3064 Network Security Assessment
c3-h2/log4j_attacker_iplistCurated list of attacker IP addresses targeting the Log4j vulnerability (CVE-2021-44228) for threat intelligence, incident response, and network…
salesforce/hasshHASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
