Tools

borsch-appreciator/soc235---atlassian-confluence-broken-access-control-0-day-cve-2023-22515

SOC analyst walkthrough triaging a Confluence CVE-2023-22515 broken access control exploitation attempt, covering log analysis, MITRE ATT&CK mapping,…

sonitbahl/sshintel

Self-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.

duggytuxy/syswarden

Host-local Linux security orchestrator enforcing nftables policy with HIDS/HIPS telemetry, bounded threat-intelligence feeds, out-of-band WAAP log…

withsecurelabs/remotepspy

Live monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…

withsecurelabs/flair

Lightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…

withsecurelabs/detectree

Interactive data visualization tool for blue teams to analyze detection data, understand relationships, reduce alert fatigue, and improve incident…

withsecurelabs/lazarus-sigma-rules

Sigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…

withsecurelabs/macostriagecollectionscript

Collects comprehensive triage data from macOS for incident response, including system logs, file listings, browser data, shell history, and…

fireeye/pywintrace

Python ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…

nadineelliottcyber/soc335-cve-2024-49138-investigation

SOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.

eshlomo1/microsoft-sentinel-secops

SOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…

thinkst/opencanary

Low-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…

infokom-ki/zimbra-cve-2026-73570-rules

Wazuh detection rules for CVE-2026-73570, an OS command injection in Zimbra Collaboration Suite, monitoring web access logs and zimbra.log for…

d3vhex/sentora

An open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.

unfold-security/cve-2026-41940-detection

Detection signatures for CVE-2026-41940 and shemas for cPanel logs

3tternp/cve-2026-41940---cpanel-whm-check

This is the office check script provided by cPanel for all the users who are using cPanel

srozb/reditrap

Minimal Redis honeypot detecting RediShell (CVE-2025-49844) exploits.

garethmsheldon/cve-2026-22557-unifi-detection

Detection content for CVE-2026-22557 — UniFi Network Application unauthenticated path traversal (CVSS 10.0). Includes YARA, Sigma, KQL, Splunk SPL,…