fabianch20/soc335---cve-2024-49138-exploitation-detectedSOC335 incident response walkthrough for CVE-2024-49138 CLFS privilege escalation, covering alert triage, threat intel enrichment, process tree…
divinelabio/argusThe Ultimate Information Gathering Toolkit
apache/spamassassinOpen-source email filtering framework that detects spam and phishing using content analysis, header checks, Bayesian scoring, and DNS blocklists.
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
redhat-infosec/priority-intelligence-requirements-devThis guide describes a process for developing Cyber Threat Intelligence Priority Intelligence Requirements
scoubi/bloodsocerAggregates MITRE ATT&CK, Sigma, and Atomic Red Team data into BloodHound graphs so SOC analysts can map detection coverage, identify gaps, and…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
cyberhatcoil/acfAndroid Connections Forensics
owasp/threat-modeling-playbookStructured playbook for integrating threat modeling into product security, covering stakeholder buy-in, organizational embedding, training, process…
shoucheng3/apache__nifi_cve-2022-33140_1-16-22Automated data flow processing and distribution system with secure configuration, provenance tracking, and extensible plugin architecture for…
shoucheng3/asf__nifi_cve-2023-36542_1-22-0Automated data flow platform for processing and distributing data with built-in provenance tracking, secure configuration, and scalable pipeline…
santhreal/keyhogOpen-source secret scanner in Rust
sentinelblue/cve-2022-29072** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the…
sf0rzin/cve-2025-61155CVE-2025-61155 — arbitrary process termination in GameDriverX64.sys (Tower of Fantasy anti-cheat). Original IDA Pro teardown, PoC, YARA, IOCs,…
mrezqi/cve-2021-1675_carbonblack_huntingqueryCarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.
garethmsheldon/cve-2025-60787-detection-motioneye-rce-via-config-injectionDetection rules and YARA/KQL signatures for CVE-2025-60787, an unauthenticated RCE in motionEye via config injection, with process execution and file…
domcyrus/rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
