zedocun/pan-os-cve-2024-3400-command-injection-investigationInvestigation of a PAN-OS CVE-2024-3400 command injection attempt, analyzing payload delivery, internal processing, and execution validation based on…
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
c3-h2/log4j_attacker_iplistCurated list of attacker IP addresses targeting the Log4j vulnerability (CVE-2021-44228) for threat intelligence, incident response, and network…
cert-hr/log4shellThis repo contains IoCs which are associated with exploitation of CVE-2021-4428.
ernestak/sigma-rule-for-cve-2022-30190Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…
grafana/lokiHorizontally scalable, multi-tenant log aggregation system that indexes labels instead of full text, integrates with Grafana, and is optimized for…
gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
owasp-modsecurity/modsecurityModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…
googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.
mattnotmax/cyberchef-recipesA list of cyber-chef recipes and curated links
reprise99/sentinel-queriesCollection of KQL queries
paulsec/awesome-windows-domain-hardeningA curated list of awesome Security Hardening techniques for Windows.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
cyb3rmik3/kql-threat-hunting-queriesA repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
