nccgroup/mimikatz-detector-condrvThe Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…
ostesayed/oste-web-log-analyzerOSTE WLA automate the process of analyzing web server logs with the Python Web Log Analyzer.
romaissaadjailia/get-applockereventlogThis is a repo for fetching Applocker event log by parsing the win-event log
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
kyos-public/keycloak-cve-2026-18963-huntHunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database
big-comfy/deadairFinds the detection rules in your SIEM that are running blind
nccgroup/mimikatz-detector-busylightUSB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is executed, a…
lascc/dfirhubSearch Windows forensic artifacts, see where each one lives on disk, and copy the KAPE command to collect it. Also builds collection scripts and…
ake13-art/secfescLightweight security state inspector for Linux — bridging the gap between pretty fetch tools and heavy-duty audit frameworks.
yossisassi/zerologon-exploitation-checkquick'n'dirty automated checks for potential exploitation of CVE-2020-1472 (aka ZeroLogon), using leading artifects in determining an actual…
adityabhatt3010/cve-2025-61882-oracle-e-business-suite-pre-auth-rce-exploitA critical pre-authentication Remote Code Execution (RCE) flaw in Oracle E-Business Suite (versions 12.2.3 - 12.2.14) allows attackers to gain full…
embee-research/sigmaA repository to release detection rules to the public
sentinelblue/cve-2022-29072** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the…
manishrawat21/detection-rulesThis repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…
seclog-open/seclogCollects multi-source security logs from reproducible Docker attack scenarios, builds attack chains, and provides the SecLog-Bench-216 benchmark for…
g0dse11/detecttraceOpen-source detection engineering tool that traces security detections end to end and identifies the first failing stage.
jondean213-pixel/quietos-sentinelSentinel — DeanWay Labs' inbound governor. Guards what an AI agent hears: world content is data, never orders. The mirror of QuietOS.
