ThreatHunting
olafhartong/threathuntingA Splunk app mapped to MITRE ATT&CK to guide your threat hunts
educationincident-responseinformation-gathering+2
1.2k
olafhartong/threathuntingA Splunk app mapped to MITRE ATT&CK to guide your threat hunts
inquest/yara-rulesCollection of YARA rules for hunting malware, malicious Office documents, and exploit artifacts, with references to samples and research write-ups.
cisagov/kev-dataMirrors CISA's Known Exploited Vulnerabilities (KEV) catalog as CSV and JSON with a JSON schema, enabling programmatic access and commit-history…
patrowl/patrowlhearsPatrowlHears - Vulnerability Intelligence Center / Exploits
threatlabz/iocsThis repository is for Indicators of Compromise (IOCs) from Zscaler ThreatLabz public reports
taxiiproject/libtaxiiA Python library for handling TAXII Messages invoking TAXII Services.
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
julioliraup/antiphishingAdvanced Phishing Protection: Suricata rulesets open and free
bushidouk/abused-legitimate-servicesCloud, CDN, and marketing services leveraged by cybercriminals and APT groups
arpsyndicate/vedas-signaturesVEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for over 15k CVEs
m4nbat/100_days_of_kql_2026A repo to hold KQL queries as part of my 100 days of KQL effort.
kaal22/darkgrid3D threat intelligence dashboard that visualizes malicious infrastructure from OSINT sources like AbuseIPDB and OpenPhish, with a live threat feed,…
vulncheck-oss/jupyter-notebooksExample Jupyter notebooks that query VulnCheck APIs to chart exploitation timelines, Known Exploited Vulnerabilities, and botnet data for threat…
cspf-founder/darwis-taxiiA high-performance TAXII (Trusted Automated eXchange of Indicator Information) server written in Rust.
pduggusa/dugganusa-ietfDugganUSA threat-intelligence contributions to the IETF Hackathon: real-world agentic-attack benchmark vectors, CVE-2026-33697 attestation analysis,…
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
