envocabulary
sreckoskocilic/envocabularyTrace every shell environment variable to its exact file and line origin. Audit shell configs for dead entries, duplicates, and orphaned files across…
configuration-auditingdigital-forensicsforensics+3
3
sreckoskocilic/envocabularyTrace every shell environment variable to its exact file and line origin. Audit shell configs for dead entries, duplicates, and orphaned files across…
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
g0thamrabb1t/cve-2026-46331-pedit-cow-detectionDefensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.
ab2pentest/macosthreattrackBash tool used for proactive detection of malicious activity on macOS systems.
cyb3rmik3/kql-threat-hunting-queriesA repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
signalapp/key-transparency-auditorContinuously fetches and cryptographically verifies key transparency log updates, maintains a condensed prefix and log tree view, and returns signed…
d0rb/packetpirateA headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems.
mthcht/threathunting-keywordsAwesome list of keywords and artifacts for Threat Hunting sessions
cyberark/ketshashA little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
sentinelblue/cve-2022-29072** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the…
0x4d31/santamonLightweight macOS detection agent built on Santa’s Endpoint Security telemetry.
rjsudlow/proxynotshell-ioc-checkerScript to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)
onsec-fr/cve-2019-19781-forensicAutomated forensic script hunting for cve-2019-19781
harshiys/cve-2007-2447-exploitation-siem-detection-labIsolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
nict-csl/existEXIST is a web application for aggregating and analyzing cyber threat intelligence.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
matanolabs/matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS