Tools

disqualifier/psa-2026-00043-recovery

Recovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)

elastic/protections-artifacts

Elastic Security detection content for Endpoint

jwa7470/cve-2026-20131-post-incident-written-report

Post-incident report on CVE-2026-20131 (CVSS 10.0), a Cisco FMC insecure deserialization vulnerability exploited by Interlock ransomware. Details…

kevin9480/security_incident_report

React2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트

essexrich/threatactors-ttps

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…

probablysecure/triage-cve-2017-0144

Goal is to triage well known attacks and learn how security teams quickly respond.

bedrock-safeguard/gentlemen-decryptor

First-ever decryptor for The Gentlemen ransomware — recovers encryption keys from process memory dumps using X25519 ephemeral key extraction. 35/35…

dannic145/eternalblue-exploit-demonstration

Educational lab demonstrating EternalBlue (MS17-010) exploitation against Windows 7 using Metasploit, including post-exploitation, WannaCry…

mkdemir/activemq-lockbit-analysis

Apache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon…

justjeff211/conti-ransomware-writeup

Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…

joshhighet/ransomwatch

the transparent ransomware claim tracker 🥷🏼🧅🖥️

vignesh-hp/lockbit-ransomware-analysis

Threat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).

vortexcry-organization/vortexcry-ransomware-release

Advanced ransomware using process injection and kernel driver loading via CVE-2019-16098 to encrypt files, disable recovery, and demand ransom. For…

crocodyli/threatactors-ttps

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…

khengar9274-web/moveit-transfer-2023-breach

Educational case study of the MOVEit Transfer SQL injection breach (CVE-2023-34362) by Cl0p ransomware group, covering attack timeline, exploitation,…

anjai7/tryhack3m-bricks-heist

TryHackMe CTF writeup — WordPress RCE via CVE-2024-25600, crypto miner forensics, and LockBit ransomware group identification

afanpan/cve-2025-29824-exploit

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

cedric-martz/ethernalblue_report

This is a security assessment report regarding the EthernalBlue vulnerability (CVE-2017-0143).