wazuh
wazuh/wazuhOpen-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…
anomaly-detectionanti-botcloud-security+12
17.2k1 day ago
wazuh/wazuhOpen-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
mgreen27/detectraptorA repository to share publicly available Velociraptor detection content
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
target/strelka-uiStrelka Web UI for File Submission and Analysis
gossithedog/threathuntingTools for hunting for threats.
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
abc1230940/soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough
andrewmichaelsmith/bluepotJava-based Bluetooth honeypot that captures and stores malware from BlueBugging and BlueSnarfing attacks, with a GUI for monitoring and log analysis.
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
exptechtw/cve-2025-66478Real-world attack log analysis of CVE-2025-66478 (Next.js Server Actions RCE) with malware samples, attacker IP tracking, and container security…
afanpan/cve-2025-29824-exploitUse after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
deividasterechovas/soc335-cve-2024-49138-exploitation-detectedDocumented incident response case for CVE-2024-49138 exploitation, featuring log analysis, hash validation, C2 detection, and containment procedures…
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
forensicxlab/vision-procmonA ProcessMonitor visualization application written in rust.
sans-blue-team/deepbluecliPowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…