
process-watcher
A process monitoring tool that tries to detect exploitation

A process monitoring tool that tries to detect exploitation

Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

A single-file native Windows tray application (C, Win32, no runtime) that shows exactly which program is sending and receiving bytes and to which…

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

This repository serves as a place for community created Targets and Modules for use with KAPE.

A wireshark plugin to instrument ETW

TheLightScope

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

Mapping Corelight or Zeek data to Elastic Common Schema fields

Mapping Corelight or Zeek data to Elastic Common Schema logs

Provides BigFix Fixlets and analyses to detect Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) across Windows and Linux…