c2detect
cognis-digital/c2detectC2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
command-and-controldefensive-toolsfingerprint-spoofing+8
43
cognis-digital/c2detectC2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
kubeshark/kubesharkeBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via…
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.
mozilla/migDistributed & real time digital forensics at the speed of the cloud
matanolabs/matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
security-onion-solutions/security-onionSecurity Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
blacksky-algorithms/atprotoFork of the AT Protocol reference implementation with performance-optimized AppView, Rust-based firehose indexer, Redis caching, and community…
corelight/zeek-quicBro analyzer that detects Google's QUIC protocol
gmh5225/gatekeeperSelf-hosted SSH access gateway in Go with OIDC/LDAP auth, RBAC, MFA, session recording, audit export, encryption at rest, IP rules, and policy…
chrisandoryan/nethive-projectRestructured and Collaborated SIEM and CVSS Infrastructure. Presented at Blackhat Asia Arsenal 2020.
lightless-labs/third-thoughtsResearch toolkit for analyzing AI agent behavioral patterns through multi-disciplinary corpus analysis. Parses session logs, runs 23 analytical…
corelight/zeek-long-connectionsZeek package for tracking long connections to report them before they have completed.
mithileshan/soc-investigation-labEnd-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190
m2l33k/blockguardBlockGuard is a Windows Data Loss Prevention (DLP) agent that intercepts and controls file access at the process level. It ensures that only…