EVTX-ATTACK-SAMPLES
sbousseaden/evtx-attack-samplesCurated collection of Windows EVTX attack samples mapped to MITRE ATT&CK techniques, designed for testing detection scripts, DFIR training, and…
curated-resourcesdigital-forensicseducation+2
2.6k
sbousseaden/evtx-attack-samplesCurated collection of Windows EVTX attack samples mapped to MITRE ATT&CK techniques, designed for testing detection scripts, DFIR training, and…
withsecurelabs/remotepspyLive monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
withsecurelabs/detectreeInteractive data visualization tool for blue teams to analyze detection data, understand relationships, reduce alert fatigue, and improve incident…
eshlomo1/microsoft-sentinel-secopsSOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…
habibkaratas/sorry-ransomware-analysisSorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign
thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…
byinarie/zirconiumTool to search for IOCs related to HAFNIUM: CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065
nate0634034090/bug-free-memoryCurated threat intelligence repository providing vetted OSINT sources, threat reports, and indicators of compromise to support organizations during…
lupovis/honeypot-for-cve-2025-59287-wsusDefensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic analysis,…
m0d0ri205/cve-2026-24858Detailed analysis of Fortinet FortiCloud SSO authentication bypass (CVE-2026-24858) including technical breakdown, attack scenarios, detection…
fevar54/cve-2026-3502-scanner---trueconf-vulnerability-detection-toolScanner de CVE-2026-3502: detecta clientes TrueConf vulnerables e IOCs de TrueChaos. Reportes JSON/HTML/CSV.
fevar54/cve-2026-33634-scannerScanner de IOCs del ataque de cadena de suministro TeamPCP (CVE-2026-33634).
bilal3755/detecting_blue_hammer_vulnThreat hunting query for bluehammer CVE windows CVE-2026-33825
222dff-afk/blackash-cve-2025-61882Provides a detailed CVE-2025-61882 advisory with technical analysis, IOCs, detection queries, and a nuclei-based exploit template for Oracle…
fabacab/awesome-cybersecurity-blueteam💻🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
vc0rexor/quick-analysisProvides rapid triage and summarization of malware samples and threat indicators, highlighting key behavioral and contextual details for analysts.
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…