awesome-lists
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
curated-resourcesdigital-forensicseducation+4
1.9k
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
stevenblack/hosts🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
ransomlook/ransomlookYet another Ransomware gang tracker
elastic/protections-artifactsElastic Security detection content for Endpoint
rivitna/malwareCurated YARA rules and detection programs for identifying ransomware families, providing signature-based indicators for malware triage, threat…
bushidouk/ransomware-tool-matrixA resource containing all the tools each ransomware gangs uses
mukendi/kratosminifilterKratos is a high-performance Windows File System Minifilter driver designed to detect, block, and permanently immunize
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
limo57640-crypto/cpanel-cve-41940-detectorRead-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.
threatlabz/toolsTools developed by the Zscaler ThreatLabz Threat Intelligence team
habibkaratas/sorry-ransomware-analysisSorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign
buter-chkalova/rvbbitsafeA next-generation multi-echelon anti-ransomware fortress for Windows, combining hypervisor, eBPF, AI deception, and hardware-enforced security.
mkdemir/activemq-lockbit-analysisApache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon…
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
joshhighet/ransomwatchthe transparent ransomware claim tracker 🥷🏼🧅🖥️
vignesh-hp/lockbit-ransomware-analysisThreat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).
cert-orangecyberdefense/ransomware_mapMap tracking ransomware, by OCD World Watch team
crocodyli/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…