sans-blue-team/deepbluecliPowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…
badchars/darknet-mcp-server66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit…
ccob/beaconeyeHunts out CobaltStrike beacons and logs operator command output
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
password123456/malwarescannerHash-based malware scanner for incident response. Scans files recursively using known malware hashes, supports multithreading, extension filtering,…
checkpointsw/nodejs-tracerRuntime tracer for Node.js malware analysis that hooks core modules, logs calls, spoofs anti-analysis checks, and captures file writes and HTTP…
limo57640-crypto/cpanel-cve-41940-detectorRead-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.
pandare9x/yara-rulesRepository of Yara Rules
arosenmund/defcon33_silence_kill_edrHands-on DEFCON workshop materials for killing and silencing EDR agents: lab setup, BYOVD, custom C/C++ evasion tooling, and reverse engineering.
blacksnufkin/rusty-playgroundSome Rust program I wrote while learning Malware Development
deividasterechovas/soc335-cve-2024-49138-exploitation-detectedDocumented incident response case for CVE-2024-49138 exploitation, featuring log analysis, hash validation, C2 detection, and containment procedures…
tomchop/malcomMalcom - Malware Communications Analyzer
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
