Tools

ashok523/cve-2026-31431

Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…

0x0allenace/soc-analyst-portfolio

A curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…

beenuar/aisoc

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…

mthcht/purpleteam

Purpleteam scripts simulation & Detection - trigger events for SOC detections

mthcht/threathunting-keywords

Awesome list of keywords and artifacts for Threat Hunting sessions

corelight/elasticsearch_rules

Elastic version of SOC prime watcher rules

nktris/htsoc

Reproducible SOC lab for CVE-2024-4577 detection and response

zedocun/sharepoint-cve-2023-29375-incident-response

End-to-end SOC incident analysis and threat hunting playbook targeting Microsoft SharePoint privilege escalation (CVE-2023-29375) using SIEM logs,…

cyberbibs/soc274---palo-alto-networks-pan-os-command-injection-vulnerability-exploitation-cve-2024-3400-

Step-by-step SOC analyst walkthrough for investigating and remediating CVE-2024-3400 (PAN-OS command injection). Covers detection, log analysis,…

deividasterechovas/soc227-microsoft-sharepoint-server-elevation-of-privilege-possible-cve-2023-29357-exploitation

SOC case analysis walkthrough demonstrating detection and response to CVE-2023-29357 privilege escalation in Microsoft SharePoint Server, including…

ptd200110/cve-2024-27198-soc-lab

SOC detection and incident response lab simulating CVE-2024-27198 authentication bypass in JetBrains TeamCity. Includes ELK SIEM, Suricata IDS, Sigma…

manishrawat21/detection-rules

This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…

mithileshan/soc-investigation-lab

End-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190

justjeff211/conti-ransomware-writeup

Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…

safelineman/agentic-soc-simulation

AI 驱动的 SOC 仿真平台

thecyberfairy/cve-lfi-lab

A hands on lab investigating CVE-2025-39507 from a Tier 1 SOC analyst perspective. Includes log review in Microsoft Sentinel, IP analysis, real world…

ernestak/sigma-rule-for-cve-2022-30190

Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…