cyprianatsyor/letsdefend-cve2024-3400-case-studyDetection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs,…
alexpena5635/cve-2021-44228_scanner-main-modified-Scans jar, war, and ear files for the presence of JndiLookup.class to detect applications vulnerable to CVE-2021-44228 (Log4Shell).
wheezysec/cve-2021-44228-kustoKusto query-based detection and analysis tool for CVE-2021-44228 (Log4Shell) vulnerability, enabling rapid log hunting and exploitation…
tica506/siem-queries-for-cve-2021-44228SIEM query collection for detecting Log4Shell (CVE-2021-44228) exploitation attempts. Provides ready-to-use detection rules for security monitoring…
matijamiki/ranwhatFlight recorder and secret scanner for AI coding agents. Reads what Claude Code, Codex, Gemini CLI and 9 more ran, and flags risky actions and leaked…
mandiant/mandiant-azure-ad-investigatorRead-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
eshlomo1/microsoft-sentinel-secopsSOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…
t3l3m3try/threat_huntingSome Threat Hunting queries useful for blue teamers
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
abdeljalilait/kerneleyeKernel-level security & attack response for Linux servers.
nccgroup/burp-refluxBurp proxy text log converter to CSV and SQLLite
all3xj/fixing-google-secops-detectionsTuning and refactoring Google Chronicle Curated Detections to eliminate alert fatigue and fix logic gaps/bugs.
emrekybs/nginxhunterAnalyzes Nginx access logs to detect SQL injection, scanner tools, webshells, and exploitation attempts, aiding system administrators in server…
fevar54/cve-2026-76461-detection-kit-Defensive detection kit for CVE-2026-76461, a critical SQL injection in Cisco Secure Email Gateway, with Sigma and YARA rules, IOCs, and remediation…
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
owasp/python-honeypotOWASP Honeypot, Automated Deception Framework.
