fatt
0x4d31/fattFATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
network-forensicspacket-sniffing-analysisthreat-intelligence
0x4d31/fattFATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
misp/misp-wiresharkLua plugin to extract data from Wireshark and convert it into MISP format
corelight/corelightforsplunkSplunk app for integrating and analyzing Corelight network detection data, enabling real-time threat hunting and incident response.
tomchop/malcomMalcom - Malware Communications Analyzer
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
fox-it/spookyssl-pcapsPCAPs and Suricata signatures for detecting OpenSSL CVE-2022-3602 exploitation attempts, including malicious client/server traffic and legitimate…
hacklcx/hfishEnterprise-grade honeypot system for detecting internal network breaches, external threats, and producing threat intelligence with 90+ service…
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
dinotools/dionaeaLow-interaction honeypot that emulates vulnerable network services to capture malware, shellcode, and exploit attempts, with IPv6 and TLS support.
stamusnetworks/sciriusWeb interface for Suricata ruleset management, threat hunting, and rule tuning with multi-source feed aggregation, transformation, and activity…
sentrypeer/sentrypeerDistributed SIP honeypot that detects and shares fraud data on VoIP attacks. Collects bad actor IPs and phone numbers via peer-to-peer network, with…
datadog/hashYAML-configurable low-interactive honeypot framework for deploying HTTP/HTTPS-based deception servers with built-in honeytraps and Datadog log…
binarydefense/log4j-honeypot-flaskInternal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228
staaldraad/fastfluxanalysisScripts to detect Fast-Flux and DGA using DNS query responses
cymmetria/ciscoasa_honeypotA low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.
offseq/threat-finderRuntime vulnerability scanner: finds CVEs in the services actually running on a host and ranks them by network exposure.