Threat-Hunting
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
educationincident-responseinformation-gathering+4
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
ghassan-elsman/crow-eyeOpen-source Windows forensics engine that acquires, parses, and correlates artifacts (MFT, USN, Registry, etc.) to reconstruct timelines with…
swimlane/soc-fakerA python package for use in generating fake data for SOC and security automation.
randomuserid/tyliumPrimary data pipelines for intrusion detection, security analytics and threat hunting
trinitor/netstat2neo4jcreate cypher create statements for neo4j out of netstat files from multiple machines
kjean13/adftActive Directory Forensic Toolkit : Detect & reconstruct AD attacks from Windows event logs (EVTX)
logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
umidguluzada/cyberdefense-labA complete Blue Team Cybersecurity Lab featuring pfSense, Suricata, and ELK Stack for network monitoring and threat detection.
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
teycir/diffcatcherA Rust CLI tool that recursively discovers Git repositories, captures state changes, generates diffs, extracts code elements with full snippets, and…
srkyn/nginx-map-risk-auditDefensive NGINX CVE-2026-42533 map regex risk audit with config scanner, Splunk/Defender notes, and lab evidence.
zenzue/cve-2025-50154PowerShell toolkit to audit, harden, and hunt for insecure NTLM/SMB usage, addressing CVE-2025-50154 credential leak risks with event log analysis…
adham504/sentinelthread-forensicsHigh-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…
m2l33k/blockguardBlockGuard is a Windows Data Loss Prevention (DLP) agent that intercepts and controls file access at the process level. It ensures that only…
0warn/defenderThis is a bash script focus on hardening linux. This is a custom think of windows defender but unlike of their privacy issue. User can feel freedom…
cameloo1/sharepoint-toolshell-micro-postmortemReproducible incident micro-postmortem for on-prem Microsoft SharePoint “ToolShell” (CVE-2025-53770): ATT&CK snapshot, “logs that matter” table,…
adnansiyat/how-to-patch-cve-2025-32709Real-world patching workflow for CVE-2025-32709. From hotfix install to SIEM alert validation—this repo documents every step with screenshots,…