Elenchi di sicurezza per rilevamenti SOC/DFIR

🐾 Threat Hunting:

📂 Le mie liste di rilevamento

📋 Liste: https://github.com/mthcht/awesome-lists/tree/main/Lists
🕵️‍♂️ Guide ThreatHunting: https://mthcht.medium.com/list/threat-hunting-708624e9266f
🚰 Named pipe sospette: suspicious_named_pipe_list.csv
🌐 TLD sospetti (aggiornati automaticamente): [suspicious_TLDs]
🌐 ASN sospetti (aggiornati automaticamente): [suspicious ASNs]
🌐 FYI: database GeoIP Maxmind (aggiornato automaticamente): GeoIP DB
🆔 ID app OAuth sospetti: OauthSentry
🔧 Servizi Windows sospetti: suspicious_windows_services_names_list.csv
⏲️ Attività di Windows sospette: suspicious_windows_tasks_list.csv
🚪 Porta di destinazione sospetta: suspicious_ports_list.csv
🛡️ Regole firewall sospette: suspicious_windows_firewall_rules_list.csv
🆔 User-Agent sospetto: suspicious_http_user_agents_list.csv
🔏 Firmatario di certificati sospetto: [suspicious CERTS]
📇 ID USB sospetti: suspicious_usb_ids_list.csv
🏷️ Nomi di mutex sospetti: suspicious_mutex_names_list.csv

Aggiorno regolarmente la maggior parte di queste liste dopo ogni strumento che analizzo nel mio progetto detection keywords

Altre liste

🛡️ DFIR:

🚫 Feed IOC/Blacklist:

🐙 Github

Altre liste github

🖥️ Correlati a SIEM/SOC/PurpleTeam:

- [EDR Telemetry](https://github.com/tsale/EDR-Telemetry) - [PurpleTeam Scripts](https://github.com/mthcht/Purpleteam) - [Awesome-SOC](https://github.com/cyb3rxp/awesome-soc) - [Awesome SOC analyst](https://github.com/st0pp3r/awesome-soc-analyst) - [Threat-Hunting con Splunk](https://github.com/mthcht/ThreatHunting-Keywords) - [Elenchi di rilevamento](https://github.com/mthcht/awesome-lists/Lists) - [PurpleTeam atomics](https://github.com/redcanaryco/atomic-red-team)

📊 TI TTP/Framework/Modelli/Tracker

🕵️‍♂️ Indagine

📊 Controlli TI

🔬 Sandbox / Emulazione

🧩 Manipolazione dei dati

📡 Risorse di rilevamento

🌐 Notizie sulla sicurezza

- [Feed del blog di Adam Chester](https://blog.xpnsec.com/rss.xml) - [feed APT di ahnlab](https://asec.ahnlab.com/en/category/apt-en/feed/) - [feed CERT di ahnlab](https://asec.ahnlab.com/en/category/cert-en/feed) - [feed phishing di ahnlab](https://asec.ahnlab.com/en/category/phishing-scam-en/feed) - [feed trend di ahnlab](https://asec.ahnlab.com/en/category/trend-en/feed) - [feed del blog di Akamai](https://feeds.feedburner.com/akamai/blog) - [feed del blog di analisi malware di Any.run](https://any.run/cybersecurity-blog/category/malware-analysis/feed/) - [feed del blog di Avast](https://blog.avast.com/rss.xml) - [badsectorlabs Last week in security - Redteam](https://blog.badsectorlabs.com/feeds/all.atom.xml) - [feed del blog di bi-zone](https://medium.com/feed/@bi-zone) - [feed dei laboratori bitdefender](https://www.bitdefender.com/nuxt/api/en-us/rss/labs/) - [feed del blog di binarydefense](https://www.binarydefense.com/feed/) - [Blog di Blackberry](https://blogs.blackberry.com/en/home) - [Feed di Bleepingcomputer](https://www.bleepingcomputer.com/feed/) - [feed di bleepingcomputer](https://www.bleepingcomputer.com/feed/) - [feed del blog di broadcom](https://sed-cms.broadcom.com/rss/v1/blogs/rss.xml) - [Avvisi CERT FR](https://www.cert.ssi.gouv.fr/alerte/) - [Pareri CERT FR](https://www.cert.ssi.gouv.fr/avis/) - [feed CERT LV](https://cert.lv/en/feed/rss/all) - [feed CERT PL](https://cert.pl/en/rss.xml) - [feed CERT SE](https://www.cert.se/feed.rss) - [feed CERT SI](https://www.cert.si/en/category/news/feed/) - [feed CERT UA](https://cert.gov.ua/api/articles/rss) - [CERT-FR](https://www.cert.ssi.gouv.fr/) - [feed di Checkpoint Research](https://research.checkpoint.com/feed) - [feed CIRT bd](https://www.cirt.gov.bd/feed/) - [feed delle notizie CISA](https://www.cisa.gov/cybersecurity-advisories/all.xml) - [Notizie CISA](https://www.cisa.gov/news-events/news) - [Cisco Talos](https://www.talosintelligence.com/) - [ricerca claroty team82](https://claroty.com/team82/research/) - [feed sulla sicurezza di Cloudfare](https://blog.cloudflare.com/tag/security/rss) - [Feed di Clément Notin](https://clement.notin.org/feed.xml) - [blog delle operazioni counter adversary di crowdstrike](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) - [blog di deepinstinct](https://www.deepinstinct.com/blog) - [detect.fyi](https://detect.fyi/) - [Detection engineering weekly](https://www.detectionengineering.net/) - [Notizie settimanali DFIR](https://thisweekin4n6.com/) - [feed delle notizie settimanali DFIR](https://thisweekin4n6.wordpress.com/feed/) - [feed degli avvisi virus drweb](https://news.drweb.com/rss/get/?c=9) - [threat intel eclecticiq](https://www-eclecticiq-com.sandbox.hs-sites.com/blog?type=intelligence-research#overview) - [blog dei laboratori di sicurezza Elastic](https://www.elastic.co/security-labs) - [feed del blog dei laboratori di sicurezza elastic](https://www.elastic.co/security-labs/rss/feed.xml) - [Blog di EricaZelic](https://ericazelic.medium.com/) - [blog del laboratorio forcepoint](https://www.forcepoint.com/blog/x-labs) - [feed threat intel genians](https://www.genians.co.kr/blog/threat_intelligence/rss.xml) - [feed threat intel gi7w0rm](https://medium.com/feed/@gi7w0rm) - [feed del blog Google Project Zero](https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss) - [feed Google threat intelligence](https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v) - [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence) - [feed dell'analisi delle minacce Google](https://blog.google/threat-analysis-group/rss/) - [feed Group-IB](https://blog.group-ib.com/rss.xml) - [Feed HackerNews](https://feeds.feedburner.com/TheHackersNews) - [feed del laboratorio harfanglab](https://harfanglab.io/insidethelab/feed/) - [feed del blog hexacorn](http://www.hexacorn.com/blog/feed/) - [Feed horizon3](https://www.horizon3.ai/feed/) - [blog hunt.io](https://hunt.io/blog) - [feed del blog huntress](https://www.huntress.com/blog/rss.xml) - [feed IC3 CSA](https://www.ic3.gov/CSA/rss) - [Feed di notizie Infostealers Hub](https://www.infostealers.com/learn-info-stealers/feed/) - [feed dei report infostealers](https://www.infostealers.com/info-stealers-reports/feed/) - [feed Intrinsec](https://www.intrinsec.com/feed/) - [feed isc sans edu](https://isc.sans.edu/rssfeed.xml) - [feed JPCERT](https://blogs.jpcert.or.jp/en/atom.xml) - [JPCERT](https://www.jpcert.or.jp/english/) - [feed krebsonsecurity](https://krebsonsecurity.com/feed/) - [feed del blog malwarebytes](https://www.malwarebytes.com/blog/feed/index.xml) - [feed malwaretech](https://www.malwaretech.com/feed) - [Blog di Mauricio Velazco](https://medium.com/@mvelazco) - [feed dei laboratori mcafee](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/feed/) - [Blog di Michael Haag](https://haggis-m.medium.com/) - [feed del blog sulla sicurezza Microsoft](https://www.microsoft.com/en-us/security/blog/feed/) - [Hub ninja di risposta agli incidenti Microsoft](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/welcome-to-the-microsoft-incident-response-ninja-hub/4243594) - [feed Microsoft Threat Intel](https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed) - [ricerca sulle minacce morphisec](https://blog.morphisec.com/topic/threat-research) - [feed di ricerca NCC Group](https://research.nccgroup.com/feed/) - [blog di ricerca sulla sicurezza nccgroup](https://www.nccgroup.com/us/research-blog/?resource=18345&category=18146#hub) - [feed delle notizie NCSC](https://feeds.english.ncsc.nl/news.rss) - [CVE NIST](https://nvd.nist.gov/vuln/search/results?isCpeNameSearch=false&results_type=overview&form_type=Basic&search_type=all&startIndex=0) - [feed di approfondimenti sulla cybersecurity NIST](https://www.nist.gov/blogs/cybersecurity-insights/rss.xml) - [Ricerca offensiva - DSAS di INJECT](https://blog.injectexp.dev/) - [Intel orangecyberdefense](https://www.orangecyberdefense.com/global/blog?tx_solr%5Bfilter%5D%5B0%5D=tags%3AIntelligence-led+Security) - [feed di ricerca e threat intel outpost24](https://outpost24.com/blog/category/research-and-threat-intel/feed/) - [threat insight di proofpoint](https://www.proofpoint.com/us/blog/threat-insight#) - [feed di ricerca sulle minacce Qualys](https://blog.qualys.com/vulnerabilities-threat-research/feed) - [feed redcanary](https://www.redcanary.co/feed/) - [ricerca sulle minacce reversinglabs](https://www.reversinglabs.com/blog/tag/threat-research) - [blog sans](https://www.sans.org/blog/) - [threat intel security.com](https://www.security.com/threat-intelligence) - [feed APT securityaffairs](https://securityaffairs.com/category/apt/feed) - [feed securityweek](https://www.securityweek.com/feed/) - [feed degli attacchi mirati APT securlist](https://securelist.com/threat-category/apt-targeted-attacks/feed/) - [Blog di Sekoia](https://blog.sekoia.io/) - [feed del blog Sekoia](https://blog.sekoia.io/feed/) - [feed dei laboratori SentinelOne](https://www.sentinelone.com/labs/feed/) - [blog tecnico seqrite](https://www.seqrite.com/blog/category/technical/) - [feed del blog di Simone Kraus](https://medium.com/feed/@simone.kraus) - [feed di ricerca sulle minacce sophos](https://news.sophos.com/en-us/category/threat-research/feed/) - [feed specterops](https://posts.specterops.io/feed) - [Blog di ricerca Splunk](https://www.splunk.com/en_us/blog/author/secmrkt-research.html) - [feed delle notizie Sybersecyrity](https://cybersecuritynews.com/feed/) - [feed Talos](https://feeds.feedburner.com/feedburner/Talos) - [Blog di tenable](https://medium.com/tenable-techblog) - [feed The HackerNews](https://feeds.feedburner.com/TheHackersNews) - [feed thedfirreport](https://thedfirreport.com/feed/) - [feed del blog threat connect](https://threatconnect.com/blog/feed/) - [blog threatlabz zscaler](https://threatlabz.zscaler.com/blogs) - [feed threatpost](https://threatpost.com/feed/) - [feed sulla sicurezza trendmicro](http://feeds.trendmicro.com/TrendMicroSimplySecurity) - [feed del blog Trustwave](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rss.xml) - [Twitter](https://twitter.com/home) - [feed Unit42](http://feeds.feedburner.com/Unit42) - [feed Unit42](https://unit42.paloaltonetworks.com/feed/) - [feed virusbulletin](https://www.virusbulletin.com/rss) - [virusbulletin](https://www.virusbulletin.com/virusbulletin/) - [feed del blog volexity](https://www.volexity.com/blog/feed/) - [feed welivesecurity](https://www.welivesecurity.com/en/rss/feed/) - [newsletter tl;dr sec](https://tldrsec.com/)

📺 Canali Youtube/Twitch

🎙️ Podcast

💬 Canali Discord /Slack

📚 Formazione

DFIR

13cubed - Investigare gli endpoint Windows 13cubed.com -windows endpoints
13cubed - Investigare la memoria di Windows 13cubed.com -windows memory
13cubed - Investigare i dispositivi Linux 13cubed.com - linux
SANS: FOR500
SANS: FOR508
Defensive-security: Linux-live-forensics
@0gtweet - Corso di digital forensics: Mastering Windows Forensics
@DebugPrivilege : Corso gratuito di Forensic Debugging InsightEngineering
Sfide:
- Immagini disco Arsenal Recon per la DFIR: publicly-accessible-disk-images
- @inversecos - Laboratori di emulazione APT: xintra
- @TheDFIRReport : Laboratori con i log dei report esistenti dfir-labs
- @ACEresponder: Corsi con spiegazioni dettagliate e laboratori aceresponder.com
- @binaryz0ne: Sfide DFIR con Datasets + Laboratorio di digital forensics Linux

SOC

📚 Libri

DFIR

📚 Siti di approfondimento

🧪 Laboratorio

📦 Altro

Creazione di contenuti

Creatore di animazioni di attacco - aceresponder

🏷️ Segnalibri

⭐ Segnalibri con tutte le mie liste da importare nel tuo browser (aggiornati automaticamente) AGGIORNA SEGNALIBRI

awesome-lists

Più Popolari

Offensive

Sfide

RE / Analisi malware / Approfondimento

SOC

Approfondimenti

Sfruttamento

IA