Ransomware-Tool-Matrix
bushidouk/ransomware-tool-matrixA resource containing all the tools each ransomware gangs uses
curated-resourcesdefensive-toolsincident-response+3
1.4k
bushidouk/ransomware-tool-matrixA resource containing all the tools each ransomware gangs uses
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
mrcord77/beacon-hunterDetects phi-structured C2 beacons that evade RITA and standard regularity-based detectors
nebulock-inc/agentic-threat-hunting-frameworkATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
kunai-project/kunaieBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident…
creamyg31337/ncentral-compromise-ioc-triageRead-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints
sherlock-project/sherlockHunt down social media accounts by username across social networks
backbay-labs/thrunt-godThreat hunting command system for agentic IDEs
hybridbrothers/hunting-queries-detection-rulesThe purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious…
jconeby/elastic-peak-dashboardsPEAK Baseline Threat Hunt dashboards for Security Onion 3.0 — covering DNS, HTTP, TLS, SMB, Kerberos, SSH, RDP, DCE/RPC, LDAP, Modbus, DNP3,…
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
deepfence/threatmapperOpen Source Cloud Native Application Protection Platform (CNAPP)
ashok523/cve-2026-31431Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…
cameloo1/sharepoint-toolshell-micro-postmortemReproducible incident micro-postmortem for on-prem Microsoft SharePoint “ToolShell” (CVE-2025-53770): ATT&CK snapshot, “logs that matter” table,…
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
zenzue/cve-2025-50154PowerShell toolkit to audit, harden, and hunt for insecure NTLM/SMB usage, addressing CVE-2025-50154 credential leak risks with event log analysis…
opencybersecurityalliance/kestrel-langKestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.