soc-investigation-lab
mithileshan/soc-investigation-labEnd-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190
educationexploitationforensics+8
mithileshan/soc-investigation-labEnd-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190
vnchk1/sec_review_cve-2024-3094Security review уязвимости CVE-2024-3094 с открытым исходным кодом
shayr1/shai-hulud-scanClaude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs
nstcyber/cve-2023-24488-siem-sigma-ruleDetect CVE-2023-24488 Exploitation Attempts
c-g-creator/letsdefend-soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298LetsDefend SOC336 case study on CVE-2025-21298
navya240/intel471-threat-hunting-cve-2023-46604My first hands-on Intel 471 threat hunting workshop experience investigating CVE-2023-46604 using Elastic SIEM, vulnerability intelligence, and…
orgito1015/cve-2025-55182-researching-processDefensive research repository for CVE-2025-55182 (Pre-Auth RCE in React Server Components/Next.js). Includes vulnerability analysis, detection rules…
liranzoz/ssh-honeypot-researchMedium-interaction SSH honeypot deployment capturing real-world brute-force traffic, malware drops, and attacker behavior. Includes TTY session…
mkdemir/activemq-lockbit-analysisApache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon…
deepinstinct/storm0978-romcom-campaignEducational repository documenting the Storm0978 RomCom campaign exploiting CVE-2023-36884, providing technical analysis and indicators for threat…
24owais/threat-intel-cve-2024-3094Threat intelligence report analyzing the xz-utils backdoor vulnerability (CVE-2024-3094)
renat0z3r0/notepadpp-supply-chain-iocsIoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale…
sastraadiwiguna-purpleeliteteaming/cisco-ios-exploitation-jaguar_tooth-cve-2017-6742-reconstructionComprehensive 100% Unrestricted Technical Analysis of JAGUAR_TOOTH Malware (APT28). High-precision reconstruction of Cisco IOS SNMP exploitation, ROP…
ngvcanh/cve-2025-55182-attack-analysisReal-world attack analysis of CVE-2025-55182 (React2Shell) - React Server Components RCE vulnerability
mishra0230/cve-2023-38831CVE-2023-38831 - WinRAR
arkha-corvus/letsdefend-soc235-atlassian-confluence-broken-access-control-0-day-cve-2023-22515-eventid-197I was presented with a high-severity alert indicating a potential exploit attempt of CVE-2023-22515, a zero-day vulnerability in Atlassian…
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.