yashubitra/mobile-intrusion-detection-systemUnsupervised deep autoencoder that flags anomalous mobile traffic: 25,000+ HTTP/HTTPS flows intercepted from a live iOS device with mitmproxy,…
owasp/agentic-evidenceOWASP reference project for agentic AI security evidence: correlates agent execution, identity, tool calls, and authorization decisions into…
swastiksagar/wazuhlabprojectHands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
foru17/neko-masterA modern and elegant dashboard for network traffic visualization and analysis.
kalidoulabghaly/log4shell-exploitation-detectionHands-on project demonstrating Log4Shell exploitation, detection engineering with Splunk and auditd, and validated remediation in a containerized…
nadineelliottcyber/soc335-cve-2024-49138-investigationSOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.
harshiys/cve-2007-2447-exploitation-siem-detection-labIsolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
the-dfir-report/sigma-rulesRules generated from our investigations.
goatmilkkk/tinyprocessorA post-processing script for TinyTracer
jonny-jhnson/telemetrysourceReference mapping Windows telemetry events—Sysmon, Security Auditing, and Threat Intelligence ETW—to underlying API functions, helping defenders…
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.
cobalt-strike/sleep_python_bridgeThis project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need…
joertx07/printnightmare-detection-labSplunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…
freeguy-6/dmz-security-monitoring-hardeningCY376 Blue Team project — pfSense DMZ, Suricata IDS/IPS, and automated host hardening against CVE-2014-6271
nccgroup/reactorRuns custom filters on Elasticsearch and alerts on matches
ny1024/clawguardModular security toolkit for autonomous agents providing static analysis, configuration auditing, runtime monitoring, and supply chain verification…
