# Listas de segurança para detecções de SOC/DFIR [![Awesome](https://awesome.re/badge.svg)](https://awesome.re) ![dt](https://assets.kitploit.com/production/public/readmes/43141/1ca7331d54b144e54b976c78292994375aa0ce385c1551f725dc5a28074c9307.jpg) ## 🐾 Threat Hunting: - [Site de palavras-chave ThreatHunting](https://mthcht.github.io/ThreatHunting-Keywords/) - [Listas de palavras-chave ThreatHunting](https://github.com/mthcht/ThreatHunting-Keywords) - [Regras Yara ThreatHunting](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) [Pesquisas ThreatHunting](https://github.com/mthcht/Purpleteam/tree/main/Detection/Threat%20Hunting/generic)

- [Pesquisas de Serviços Windows](https://detect.fyi/threat-hunting-suspicious-windows-service-names-2f0dceea204c) - [Pesquisas de User-Agents](https://mthcht.medium.com/threat-hunting-suspicious-user-agents-3dd764470bd0) - [Pesquisas de DNS Over HTTPS](https://mthcht.medium.com/detecting-dns-over-https-30fddb55ac78) - [Pesquisas de TLDs Suspeitos](https://mthcht.medium.com/threat-hunting-suspicious-tlds-a742c2adbf58) - [Pesquisas HijackLibs](https://mthcht.medium.com/detect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f) - [Pesquisas de Phishing e DNSTWIST](https://detect.fyi/detecting-phishing-attempts-with-dnstwist-37c426b3bbb8) - [Pesquisas de Extensões de Navegadores](https://mthcht.medium.com/detecting-browser-extensions-installations-e0ac2b45c46b) - [C2 escondido à vista de todos](https://mthcht.medium.com/c2-hiding-in-plain-sight-7a83963b9344) - [Artefatos de HTML Smuggling](https://mthcht.medium.com/detecting-html-smuggling-phishing-attempts-15af824e60e4) - [Pesquisas de PSEXEC e ferramentas similares](https://mthcht.medium.com/detecting-psexec-and-similar-tools-c812bf3dca6c) - [Detecção de Time Slipping](https://mthcht.medium.com/event-log-manipulations-1-time-slipping-55bf95631c40) - [Named pipes suspeitos](https://detect.fyi/threat-hunting-suspicious-named-pipes-a4206e8a4bc8)

## 📂 Minhas Listas de Detecção - 📋 Listas: https://github.com/mthcht/awesome-lists/tree/main/Lists - 🕵️‍♂️ Guias de Threat Hunting: https://mthcht.medium.com/list/threat-hunting-708624e9266f - 🚰 Named pipes suspeitos: [suspicious_named_pipe_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_named_pipe_list.csv) - 🌐 TLDs suspeitos (atualizados automaticamente): [[suspicious_TLDs]](https://github.com/mthcht/awesome-lists/tree/main/Lists/TLDs) - 🌐 ASNs suspeitos (atualizados automaticamente): [[suspicious ASNs]](https://github.com/mthcht/awesome-lists/tree/main/Lists/ASNs) - 🌐 FYI Banco de dados Maxmind GeoIP (atualizado automaticamente): [GeoIP DB](https://github.com/mthcht/awesome-lists/tree/main/Lists/ASNs/correlation_maxmind_geo_db/maxmind_databases/extracted) - 🆔 IDs de Apps Oauth suspeitos: [OauthSentry](https://oauthsentry.github.io/) - 🔧 Serviços Windows suspeitos: [suspicious_windows_services_names_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_services_names_list.csv) - ⏲️ Tarefas Windows suspeitas: [suspicious_windows_tasks_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv) - 🚪 Porta de destino suspeita: [suspicious_ports_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_ports_list.csv) - 🛡️ Regras de Firewall suspeitas: [suspicious_windows_firewall_rules_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_firewall_rules_list.csv) - 🆔 User-agent suspeito: [suspicious_http_user_agents_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv) - 🔏 Assinante de CERTs suspeito: [\[suspicious CERTS\]](https://github.com/mthcht/awesome-lists/tree/main/Lists/CERTS) - 📇 IDs USB suspeitos: [suspicious_usb_ids_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_usb_ids_list.csv) - 🏷️ Nomes de mutex suspeitos: [suspicious_mutex_names_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_mutex_names_list.csv) - 🔢 Endereço MAC suspeito: [suspicious_mac_address_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_mac_address_list.csv) - 📛 Hostname suspeito: [suspicious_hostnames_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_hostnames_list.csv) - 🌐 Extensões de Navegador suspeitas: [Browser Extensions](https://github.com/mthcht/awesome-lists/tree/main/Lists/Browser%20Extensions) - 📧 Lista de App IDs da Microsoft - Detecção de BEC [microsoft_apps_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/microsoft_apps_list.csv) - 🧮 Metadados de Executáveis: [executables_metadata_informations_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Windows%20Metadata/executables_metadata_informations_list.csv) - 🕸️ Lista de servidores DNS over HTTPS: [dns_over_https_servers_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/dns_over_https_servers_list.csv) - 🕸️ Lista de domínios de DNS dinâmico: [dyndns_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/DYNDNS/dyndns_list.csv) - 🪝 Listas de phishing: [Domínios e URLs de phishing](https://github.com/mthcht/awesome-lists/tree/main/Lists/Phishing) - 🕸️ Domínios : [\[sinkholed servers\]](https://github.com/mthcht/awesome-lists/tree/main/Lists/Domains) - 🕳️ Domínios em sinkhole : [sinkholed_domains.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Domains/sinkholed_servers/sinkholed_domains.csv) - 🕳️ Site em sinkhole: [SINKHOLED](https://github.com/sinkholed/sinkholed.github.io) - 📚 Hijacklibs (atualizados automaticamente): [hijacklibs_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Hijacklibs/hijacklibs_list.csv) - 🌐 Listas de Nós TOR (atualizadas automaticamente): [[TOR]](https://github.com/mthcht/awesome-lists/tree/main/Lists/TOR) - 🛠️ Lista LOLDriver (atualizada automaticamente): [loldrivers_only_hashes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Drivers/loldrivers_only_hashes_list.csv) - 🛠️ Lista de Bootloaders Maliciosos (atualizada automaticamente): [malicious_bootloaders_only_hashes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Drivers/malicious_bootloaders_only_hashes_list.csv) - 📜 Lista de Certificados SSL Maliciosos (atualizada automaticamente): [ssl_certificates_malicious_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/SSL%20CERTS/ssl_certificates_malicious_list.csv) - 🖥️ Detecção de RMM: [[RMM]](https://github.com/mthcht/awesome-lists/tree/main/Lists/RMM) - 👤🔑 Funções, grupos e permissões importantes para AD/EntraID/AWS/Graph: [[permissions]](https://github.com/mthcht/awesome-lists/tree/main/Lists/permissions) - 💻🔒 Extensões de ficheiro conhecidas de ransomware: [ransomware_extensions_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/ransomware_extensions_list.csv) - 💻🔒 Nomes de ficheiro conhecidos de notas de resgate de ransomware: [ransomware_notes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/ransomware_notes_list.csv) - 📝 Regras ASR do Windows: [windows_asr_rules.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/windows_asr_rules.csv) - 🌐 Listas DNSTWIST (atualizadas automaticamente): [DNSTWIST Default Domains + script](https://github.com/mthcht/awesome-lists/tree/main/Lists/Phishing/DNSTWIST) - 🌍 VPN [Listas de endereços IP](https://github.com/mthcht/awesome-lists/tree/main/Lists/VPN) (atualizadas automaticamente): - 🛡️ NordVPN: [nordvpn_ips_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/NordVPN/nordvpn_ips_list.csv) - 🛡️ ProtonVPN: [protonvpn_ip_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/ProtonVPN/protonvpn_ip_list.csv) - 🛡️ SurfShark: [surfshark_vpn_servers_domains_and_ips_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/SurfSharkVPN/surfshark_vpn_servers_domains_and_ips_list.csv) - 🛡️ MullVad: [mullvad_relay_servers_ips_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/MullVad/mullvad_relay_servers_ips_list.csv) - 🌍 PROXIES [Listas de IP/Porta de PROXY](https://github.com/mthcht/awesome-lists/tree/main/Lists/PROXY) - 🏢 Listas de intervalos de IP de empresas (atualizadas automaticamente): [Listas predefinidas + script](https://github.com/mthcht/awesome-lists/tree/main/Lists/Ranges_IP_Address_Company_List/bgp.he.net) / [Microsoft](https://github.com/mthcht/awesome-lists/tree/main/Lists/Ranges_IP_Address_Company_List/Microsoft) - 📍 Listas de serviços GeoIP: [ip_location_sites_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/GeoIP/ip_location_sites_list.csv) - 🧬 Regras Yara: [Regras yara de Threat Hunting](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) - 🧬 Padrões de deteção de ferramentas ofensivas: [offensive_tool_keywords.csv](https://raw.githubusercontent.com/mthcht/ThreatHunting-Keywords/main/offensive_tool_keyword.csv) - 🧬 Padrões de deteção de ferramentas Greyware: [greyware_tool_keyword.csv](https://raw.githubusercontent.com/mthcht/ThreatHunting-Keywords/main/greyware_tool_keyword.csv) - 🧬 Palavras-chave de assinaturas AV: [signature_keyword.csv](https://github.com/mthcht/ThreatHunting-Keywords/blob/main/signature_keyword.csv) - 🧬 Listas de assinaturas do Microsoft Defender AV: [[Defender]](https://github.com/mthcht/awesome-lists/tree/main/Lists/AV%20signatures/Defender) + [yara](https://github.com/mthcht/awesome-lists/tree/main/Lists/Others/Defender_yara_rules) - 🧬 Listas de assinaturas do ClamAV: [[ClamAV]](https://github.com/mthcht/awesome-lists/tree/main/Lists/AV%20signatures/ClamAV) - 🔗 Outras listas de correlação: [[Others]](https://github.com/mthcht/awesome-lists/tree/main/Lists/Others) - 🆔 Listas de Extensões VSCODE Suspeitas: [vsxsentry](https://vsxsentry.github.io/#feed) - 🆔 Listas de Extensões de Navegador Suspeitas: [extsentry](https://extsentry.github.io/#feeds/malicious) Atualizo regularmente a maioria destas listas após cada ferramenta que analiso no meu projeto [detection keywords](https://github.com/mthcht/ThreatHunting-Keywords) ## Outras Listas ### 🛡️ DFIR:

- [🔥 EricZimmerman Tools 🔥](https://ericzimmerman.github.io/#!index.md) - [usnjrnl_rewind](https://github.com/CyberCX-DFIR/usnjrnl_rewind) - [dfir-orc](https://github.com/dfir-orc) - [dfir-orc-config](https://github.com/DFIR-ORC/dfir-orc-config) - [Arsenal Recon Forensic tools](https://arsenalrecon.com/downloads) - [Splunk4DFIR](https://github.com/mf1d3l/Splunk4DFIR) - [dfiq](https://github.com/google/dfiq) - [Mind maps](https://github.com/AndrewRathbun/DFIRMindMaps) - [arfifacts List - DFIRArtifactMuseum](https://github.com/AndrewRathbun/DFIRArtifactMuseum) - [arfifacts List - ForensicArtifacts](https://github.com/ForensicArtifacts/artifacts) - [Autopsy](https://www.autopsy.com/download/) - [SleuthKit](https://github.com/sleuthkit/sleuthkit) - [\[OS\] SIFT Workstation](https://www.sans.org/tools/sift-workstation/) - [\[OS\] Remnux](https://remnux.org/) - [\[OS\] sof-elk](https://github.com/philhagen/sof-elk) - [\[OS\] tsurugi](https://tsurugi-linux.org/) - [\[OS\] DEFT](https://distrowatch.com/table.php?distribution=deft) - [\[OS\] Flare VM](https://github.com/mandiant/flare-vm) - [PSBits](https://github.com/gtworek/PSBits/tree/master/DFIR) - [Yara - Threat Hunting](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) + [TH](https://github.com/mthcht/ThreatHunting-Keywords) - [Yara - Forge](https://github.com/YARAHQ/yara-forge) - [capa](https://github.com/mandiant/capa) - [Malcontent](https://github.com/chainguard-dev/malcontent) - [\[Event parser\] evtx](https://github.com/omerbenamram/evtx) - [\[Event Parser\] procmon-parser](https://github.com/eronnen/procmon-parser) - [\[Event Parser\] Linux - MasterParser](https://github.com/securityjoes/MasterParser) - [\[EVTX\] Hayabusa](https://github.com/Yamato-Security/hayabusa) - [\[EVTX\] WELA](https://github.com/Yamato-Security/WELA) - [\[EVTX\] chainsaw](https://github.com/WithSecureLabs/chainsaw) - [\[EVTX\] APTHunter](https://github.com/ahmedkhlief/APT-Hunter/) - [\[EVTX / Auditd\] Zircolite](https://github.com/wagga40/Zircolite) - [werejugo](https://github.com/MarkBaggett/werejugo) - [srum-dump](https://github.com/MarkBaggett/srum-dump) - [ADTimeline](https://github.com/ANSSI-FR/ADTimeline) - [PersistenceSniper](https://github.com/last-byte/PersistenceSniper) - [\[O365\] Logs - Microsoft-Analyzer-Suite](https://github.com/evild3ad/Microsoft-Analyzer-Suite) - [Logon Tracer](https://github.com/JPCERTCC/LogonTracer) - [Timeline Plaso](https://github.com/log2timeline/plaso) - [Timeline TimeSketch](https://github.com/google/timesketch) - [regripper](https://github.com/warewolf/regripper) - [OneDrive OCR DB artifact collector exe](https://github.com/vxunderground/OCRMe/) - [OneDrive OCR DB artifact collector python ](https://github.com/Beercow/OCRMe) - [hollows hunter](https://github.com/hasherezade/hollows_hunter) - [PE sieve](https://github.com/hasherezade/pe-sieve) - [RdpCacheStitcher](https://github.com/BSI-Bund/RdpCacheStitcher) - [Searching strings - ripgrep](https://github.com/BurntSushi/ripgrep) - [Searching strings - Recoll](https://www.recoll.org/pages/recoll-windows.html) - [Kape](https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape) - [Kape Files](https://github.com/EricZimmerman/KapeFiles) - [More Kape ressources](https://github.com/AndrewRathbun/Awesome-KAPE) - [VolatileDataCollector](https://github.com/gtworek/VolatileDataCollector) - [Velociraptor](https://github.com/Velocidex/velociraptor) - [TZ tools](https://www.tzworks.com/download_links.php) - [Nirsoft tools](https://www.nirsoft.net/) - [\[memory\] MemDump](https://nircmd.nirsoft.net/memdump.html) - [\[memory\] MemProcFS](https://github.com/ufrisk/MemProcFS) - [\[memory\] MemProcFS-Analyzer](https://github.com/LETHAL-FORENSICS/MemProcFS-Analyzer) - [\[memory\] avml](https://github.com/microsoft/avml) - [\[memory\] WinPmem](https://github.com/Velocidex/WinPmem) - [\[memory\] Volatility](https://github.com/volatilityfoundation/volatility3/) - [\[Image Mount\] FTK Imager](https://www.exterro.com/ftk-product-downloads) - [\[Image Mount\] OSFMount](https://www.osforensics.com/tools/mount-disk-images.html) - [\[Network\] Network Miner](https://www.netresec.com/?page=NetworkMiner) - [\[Network\] Wireshark](https://www.wireshark.org/) - [\[Network\] xplico](https://www.xplico.org/) - [\[Carving\] PhotoRec](https://www.cgsecurity.org/wiki/PhotoRec) - [\[Carving\] Bulk Extractor](https://github.com/simsong/bulk_extractor) - [Ferramentas do Didier Stevens](https://blog.didierstevens.com/programs/) - [\[memory\] Lime](https://github.com/504ensicsLabs/LiME) - [Artefatos do Windows](https://github.com/Psmths/windows-forensic-artifacts) - [\[Linux\] UAC](https://github.com/tclahr/uac) - [\[Linux\] EXT4 / XFS - fjta](https://github.com/mnrkbys/fjta) - [listas - aboutdfir.com](https://aboutdfir.com/) - [Monitoramento - Osquery](https://github.com/osquery/osquery) - [\[Guia de IR\] OpenProject ](https://github.com/DebugPrivilege/OpenProject) - [\[Ferramentas OSX\] Knockknock](objective-see.com/products/knockknock.html) - [\[Ferramentas OSX\] mac_apt](https://github.com/ydkhatri/mac_apt) - [Extensões do Chrome para Forense de DNS](https://github.com/arsolutioner/ExtensionHound)

### 🚫 Feeds de IOC/Listas de bloqueio:

- [chainabuse (para endereços de carteiras cripto maliciosas)](https://chainabuse.com/) - [ABUSE.CH BLACKLISTS](https://sslbl.abuse.ch/blacklist/) - [Block Lists](https://github.com/blocklistproject/Lists) - [DNS Block List](https://github.com/hagezi/dns-blocklists) - [Phishing Block List](https://github.com/jarelllama/Scam-Blocklist) - [Binary Defense IP Block List](https://www.binarydefense.com/banlist.txt) - [C2IntelFeeds](https://github.com/drb-ra/C2IntelFeeds) - [Volexity TI](https://github.com/volexity/threat-intel) - [Open Source TI](https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds) - [C2 Tracker](https://github.com/montysecurity/C2-Tracker) - [Unit42 IOC](https://github.com/mthcht/iocs) - [Sekoia IOC](https://github.com/SEKOIA-IO/Community/tree/main/IOCs) - [Unit42 Timely IOC](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel) - [Unit42 Articles IOC](https://github.com/PaloAltoNetworks/Unit42-Threat-Intelligence-Article-Information) - [ThreatFOX IOC](https://threatfox.abuse.ch/export/) - [Zscaler ThreatLabz IOC](https://github.com/threatlabz/iocs) - [Zscaler ThreatLabz Ransomware notes](https://github.com/ThreatLabz/ransomware_notes) - [experiant.ca](https://fsrm.experiant.ca/api/v1/get]) - [Sophos lab IOC](https://github.com/sophoslabs/IoCs) - [ESET Research IOC](https://github.com/eset/malware-ioc) - [ExecuteMalware IOC](https://github.com/executemalware/Malware-IOCs) - [Cisco Talos IOC](https://github.com/Cisco-Talos/IOCs) - [Elastic Lab IOC](https://github.com/elastic/labs-releases/tree/main/indicators) - [SOCRadar STRU IOC](https://github.com/SOCRadarSTRU/STRU-threat-intel) - [Blackorbid APT Report IOC](https://github.com/blackorbird/APT_REPORT) - [AVAST IOC](https://github.com/avast/ioc) - [Zimperium IOC](https://github.com/Zimperium/IOC) - [HarfangLab IOC](https://github.com/HarfangLab/iocs) - [DoctorWeb IOC](https://github.com/DoctorWebLtd/malware-iocs) - [BlackLotusLab IOC](https://github.com/blacklotuslabs/IOCs) - [prodaft IOC](https://github.com/prodaft/malware-ioc) - [Pr0xylife DarkGate IOC](https://github.com/pr0xylife/DarkGate) - [Pr0xylife Latrodectus IOC](https://github.com/pr0xylife/Latrodectus) - [Pr0xylife WikiLoader IOC](https://github.com/pr0xylife/WikiLoader) - [Pr0xylife SSLoad IOC](https://github.com/pr0xylife/SSLoad) - [Pr0xylife Pikabot IOC](https://github.com/pr0xylife/Pikabot) - [Pr0xylife Matanbuchus IOC](https://github.com/pr0xylife/Matanbuchus) - [Pr0xylife QakBot IOC](https://github.com/pr0xylife/Qakbot) - [Pr0xylife IceID IOC](https://github.com/pr0xylife/IcedID) - [Pr0xylife Emotet IOC](https://github.com/pr0xylife/Emotet) - [Pr0xylife BumbleBee IOC](https://github.com/pr0xylife/Bumblebee) - [Pr0xylife Gozi IOC](https://github.com/pr0xylife/Gozi) - [Pr0xylife NanoCore IOC](https://github.com/pr0xylife/Nanocore) - [Pr0xylife NetWire IOC](https://github.com/pr0xylife/Netwire) - [Pr0xylife AsyncRAT IOC](https://github.com/pr0xylife/AsyncRAT) - [Pr0xylife Lokibot IOC](https://github.com/pr0xylife/Lokibot) - [Pr0xylife RemcosRAT IOC](https://github.com/pr0xylife/RemcosRAT) - [Pr0xylife nworm IOC](https://github.com/pr0xylife/nworm) - [Pr0xylife AZORult IOC](https://github.com/pr0xylife/AZORult) - [Pr0xylife NetSupportRAT IOC](https://github.com/pr0xylife/NetSupportRAT) - [Pr0xylife BitRAT IOC](https://github.com/pr0xylife/BitRAT) - [Pr0xylife BazarLoader IOC](https://github.com/pr0xylife/BazarLoader) - [Pr0xylife SnakeKeylogger IOC](https://github.com/pr0xylife/SnakeKeylogger) - [Pr0xylife njRat IOC](https://github.com/pr0xylife/njRat) - [Pr0xylife Vidar IOC](https://github.com/pr0xylife/Vidar) - [Pr0xylife Warmcookie IOC](https://github.com/pr0xylife/Warmcookie-Badspace) - [Cloud Intel IOC](https://github.com/unknownhad/CloudIntel) - [URLs de phishing - feed da última semana](https://file.jeroengui.be/phishing/last_week.txt) - [SpamHaus drop.txt](https://www.spamhaus.org/drop/drop.txt) - [SpamHaus drop + ASN](https://www.spamhaus.org/blocklists/do-not-route-or-peer/) - [UrlHaus_misp](https://urlhaus.abuse.ch/downloads/misp/) - [UrlHaus_misp ASN](https://urlhaus.abuse.ch/feeds/) - [UrlHaus](https://urlhaus.abuse.ch/api/#csv) - [vx-underground - Excelente recurso para amostras e relatórios de inteligência](https://vx-underground.org/Samples) - [Ransomware.live](https://ransomware.live) - [Feed de relatórios públicos do rosti.bin](https://rosti.bin.re/feeds)

### 🐙 Github

- [Mais listas do github](https://github.com/mthcht?tab=stars&user_lists_direction=asc&user_lists_sort=name)

### 🖥️ Relacionado a SIEM/SOC/PurpleTeam:

- [EDR Telemetry](https://github.com/tsale/EDR-Telemetry) - [PurpleTeam Scripts](https://github.com/mthcht/Purpleteam) - [Awesome-SOC](https://github.com/cyb3rxp/awesome-soc) - [Awesome SOC analyst](https://github.com/st0pp3r/awesome-soc-analyst) - [Threat-Hunting with Splunk](https://github.com/mthcht/ThreatHunting-Keywords) - [Detection Lists](https://github.com/mthcht/awesome-lists/Lists) - [PurpleTeam atomics](https://github.com/redcanaryco/atomic-red-team)

### 📊 TI TTP/Framework/Model/Trackers

- [Ferramentas usadas por grupos de ransomware - @BushidoToken](https://github.com/BushidoUK/Ransomware-Tool-Matrix) - [Ferramentas usadas por APT russos](https://github.com/BushidoUK/Russian-APT-Tool-Matrix) - [Ferramentas associadas a grupos (parcial)](https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU) - [Técnicas - MITRE ATT&CK](https://attack.mitre.org/techniques/enterprise/) - [Táticas - MITRE ATT&CK](https://attack.mitre.org/tactics/enterprise/) - [Matriz de convenções de nomenclatura de grupos e operações](https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU) - [Mitigação - MITRE ATT&CK](https://attack.mitre.org/mitigations/enterprise/) - [ATT&CK matrix navigator](https://mitre-attack.github.io/attack-navigator/) - [Todos os dados do MITRE em formato xlsx](https://attack.mitre.org/resources/attack-data-and-tools/) - [Ferramentas usadas por grupos de atores de ameaça - MITRE ATT&CK](https://attack.mitre.org/software/) - [atomic-red-team](https://github.com/redcanaryco/atomic-red-team) - [redcanary Threat Detection report](https://redcanary.com/threat-detection-report/) - [The-Unified-Kill-Chain](https://www.unifiedkillchain.com/assets/The-Unified-Kill-Chain.pdf) - [TTP pyramid](https://scythe.io/library/summiting-the-pyramid-of-pain-the-ttp-pyramid) - [Pyramid of pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - [Cyber Kill chain](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html) - [MITRE D3FEND](https://d3fend.mitre.org/) - [MITRE CAPEC](https://capec.mitre.org/) - [MITRE CAR](https://car.mitre.org/) - [MITRE DeTTECT](https://github.com/rabobank-cdc/DeTTECT) - [MITRE PRE-ATT&CK Techniques](https://attack.mitre.org/versions/v7/techniques/pre/) - [APTMAP](https://github.com/andreacristaldi/APTmap) - [CVE Vuln Database](https://cve.mitre.org/) - [CVE Vuln Framework](https://github.com/CERTCC/SSVC) - [REACT framework](https://atc-project.github.io/react-navigator/) - [🔥TODOS os Relatórios de TI🔥](https://github.com/mthcht/ThreatIntel-Reports) - [🔥TODAS as pesquisas de Relatórios de TI🔥](https://mthcht.github.io/ThreatIntel-Reports/)

### 🕵️‍♂️ Investigação #### 📊 Verificações de TI

- [Virustotal](https://www.virustotal.com/#/home/search) - [SpamHaus](https://check.spamhaus.org/) - [app.spur.us](https://app.spur.us/) - [AbuseIPDB](https://www.abuseipdb.com/) - [Telegram BOT hunting](https://matkap.cti.monster/) - [Malwarebazaar](https://bazaar.abuse.ch/) - [emailrep](https://emailrep.io/) - [dnsdumpster](https://dnsdumpster.com/) - [nslookup.io](https://www.nslookup.io/) - [cloudfare URL scan](https://radar.cloudflare.com/scan) - [proxy IP check - proxycheck.io](https://proxycheck.io/web/) - [reputation IP check criminalip](https://www.criminalip.io/en) - [proxy IP check - iphub.info](https://iphub.info/) - [shodan](https://www.shodan.io/) - [Onyphe](https://www.onyphe.io/) - [haveibeenpwned](https://haveibeenpwned.com/) - [leakcheck.io](https://github.com/mthcht/awesome-lists/blob/main/leakcheck.io) - [Censys](https://search.censys.io/) - [cybergordon (URL reputation check)](https://cybergordon.com/) - [threatminer](https://www.threatminer.org/) - [urlscan](https://urlscan.io/) - [Apptotal (apps and extensions analysis)](https://apptotal.io/) - [urlquery](http://urlquery.net/) - [cloudfare scanner](https://radar.cloudflare.com/) - [scamsearch.io](https://scamsearch.io/#anchorCeckNow) - [scamdb.net](https://www.scamdb.net/) - [urlvoid](https://www.urlvoid.com) - [urldna.io](https://urldna.io/) - [url checkphish](https://checkphish.bolster.ai/) - [ipvoid](https://www.ipvoid.com/) - [mxtoolbox](https://mxtoolbox.com/NetworkTools.aspx) - [mxtoolbox mail header](https://mxtoolbox.com/EmailHeaders.aspx) - [Microsoft TI](https://ti.defender.microsoft.com/) - [pulsedive](https://pulsedive.com/) - [URL Redirect Checker](https://redirect-checker.net/) - [threatbook](https://threatbook.io/) - [web archive](https://web.archive.org/) - [McAfee Threat Intelligence Exchange](https://www.mcafee.com/enterprise/en-us/products/threat-intelligence-exchange.html) - [Kaspersky Security Network](https://www.kaspersky.com/security-network) - [Microsoft Security Intelligence Report](https://www.microsoft.com/en-us/wdsi/intelligence-report) - [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) - [AlienVault OTX](https://otx.alienvault.com/) - [greynoise](https://viz.greynoise.io/) - [whoxy](https://www.whoxy.com/reverse-whois/) - [url tiny-scan](https://www.tiny-scan.com/) - [certificates - crt.sh](https://crt.sh/) - [site web-check](https://web-check.as93.net/) - [validin.com](https://app.validin.com/) - [Browser Extension CRX checker](https://crxaminer.tech/) - [.EXE lookup - echotrail](https://www.echotrail.io/) - [Malware-Traffic-Analysis (PCAP files)](https://malware-traffic-analysis.net/) - [redhuntlabs](https://redhuntlabs.com/online-ide-search) - [whois domaintools](https://whois.domaintools.com/) - [ASN check bgp.he](https://github.com/mthcht/awesome-lists/blob/main/bgp.he.net) - [viewdns](http://viewdns.info/) - [OUI mac address lookup](https://www.wireshark.org/tools/oui-lookup.html) - [macvendorlookup](https://www.macvendorlookup.com/) - [.EXE lookup - xcyclopedia](https://strontic.github.io/xcyclopedia/) - [abuse.ch](https://abuse.ch/#platforms) - [malware-traffic-analysis](https://www.malware-traffic-analysis.net/index.html) - [waybackmachine](http://web.archive.org/) - [Online Paste Tools Lookup](https://redhuntlabs.com/online-ide-search/) - [dnshistory](https://dnshistory.org/) - [asnlookup](https://asnlookup.com/) - [Browser extension checker - CRXaminer](https://crxaminer.tech/) - [ipinfo.io](https://ipinfo.io) - [fofa.info](https://fofa.info/) - [SecurityTrail](https://securitytrails.com/) - [ZommEye](https://www.zoomeye.ai/) - [BlueCoat lookup](https://sitereview.bluecoat.com/) - [Norton lookup](https://safeweb.norton.com/) - [Fortinet lookup](https://www.fortiguard.com/webfilter) - [McAfee lookup](https://sitelookup.mcafee.com/) - [Trellix lookup](https://trustedsource.org/) - [Palo Alto lookup](https://urlfiltering.paloaltonetworks.com/query/) - [Talos Intelligence lookup](https://www.talosintelligence.com/reputation_center) - [Consulta Checkpoint](https://urlcat.checkpoint.com/urlcat/main.htm) - [Consulta Cyren](https://www.cyren.com/security-center/url-category-check-gate) - [Consulta Forcepoint](https://support.forcepoint.com/s/site-lookup) - [Consulta TrendMicro](https://global.sitesafety.trendmicro.com/) - [Banco de dados USB e PCI - DeviceHunt](https://devicehunt.com/) #### 🔬 Sandbox / Emulação

- [Sandbox Anyrun](https://any.run/) - [triage](https://tria.ge/s) - [capesandbox](https://www.capesandbox.com/) - [joesandbox](https://www.joesandbox.com/analysispaged/0) - [filescan.io](https://www.filescan.io/) - [Hybrid Analysis](https://www.hybrid-analysis.com/) - [virustotal](https://www.virustotal.com) - [threat zone](https://app.threat.zone/scan) - [vmray](https://www.vmray.com/) - [kaspersky opentip](https://opentip.kaspersky.com/requests) - [speakeasy (emulação em modo kernel e usuário)](https://github.com/mandiant/speakeasy) - [DOGGuard](https://app.docguard.io/) - [Kaspersky Threat Intelligence Portal](https://opentip.kaspersky.com/?tab=upload)

### 🧩 Manipulação de dados

- [CyberChef](https://gchq.github.io/CyberChef/) - [jsoncrack](https://jsoncrack.com/editor) - [Grok debugger](https://grokdebugger.com/) - [JS deobfuscator](https://lelinhtinh.github.io/de4js/) - [PCAP online analyzer](https://apackets.com/) - [Hash calculator](https://md5calc.com/hash) - [regex101](https://regex101.com/) - [PCAP Analyzer Online](https://apackets.com/) - [Javascript Deobfuscator - deobfuscate.relative.im](https://deobfuscate.relative.im/) - [Javascript Deobfuscator - de4js](https://lelinhtinh.github.io/de4js/) - [JSONViewer](https://jsonviewer.stack.hu/) - [TextMechanic](https://textmechanic.com/) - [UrlEncode.org](https://www.urlencoder.org/) - [TextFixer](https://www.textfixer.com/) - [RegExr](https://regexr.com/) - [TextUtils](https://textutils.com/) - [TextCompactor](https://textcompactor.com/) - [Pretty Diff](https://prettydiff.com/) - [XML Tree](http://www.xmltree.com/) - [Online XML Formatter and Beautifier](https://www.freeformatter.com/xml-formatter.html) - [XML Escape Tool](https://www.freeformatter.com/xml-escape.html) - [DiffChecker](https://www.diffchecker.com/) - [CSVJSON](https://www.csvjson.com/) - [HTML Formatter](https://htmlformatter.com/) - [Text Tool](https://texttools.netlify.app/) - [String Manipulation Tool](https://string-functions.com/) - [unshorten it](https://www.unshorten.it) - [urlunscrambler](https://www.urlunscrambler.com/) - [URLEncode & Decode](https://www.urlencoder.org/) - [longurl](https://www.longurl.org/) - [Message Header](https://mha.azurewebsites.net/pages/mha.html) - [MXToolbox EmailHeaders](https://mxtoolbox.com/EmailHeaders.aspx) - [Email Header Analyzer](https://emailheaders.verification-check.com/) - [Email Header Analysis](https://www.email-format.com/header-analysis/) - [Gitlab dashboard from Excel](https://thisdavej.com/copy-table-in-excel-and-paste-as-a-markdown-table/) - [uncoder](https://uncoder.io/) - [DeHashed](https://dehashed.com/) - [Diff Checker](https://www.diffchecker.com/) - [IT tools](https://it-tools.tech/) - [ChatGPT](https://chatgpt.com/)

### 📡 Recursos de Detecção

- [Listas de Detecção](https://github.com/mthcht/awesome-lists/tree/main/Lists) - [Técnicas MITRE](https://attack.mitre.org/techniques/enterprise/) - [Atualizações MITRE](https://attack.mitre.org/resources/updates/) - [MITRE D3fend](https://d3fend.mitre.org/) - [MITRE Navigator](https://mitre-attack.github.io/attack-navigator/) - [Fontes de Dados MITRE](https://attack.mitre.org/datasources/) - [GTFOBIN](https://github.com/mthcht/GTFOBins.github.io) - [LOLBAS](https://github.com/mthcht/LOLBAS) - [LOTS](https://lots-project.com/) - [LOLRMM](https://github.com/magicsword-io/LOLRMM) - [loldrivers](https://www.loldrivers.io/) - [LOLRMM](https://github.com/magicsword-io/LOLRMM) - [LOLC2](https://github.com/lolc2/lolc2.github.io) - [LOLESXI](https://github.com/LOLESXi-Project/LOLESXi) - [WTFBIN](https://wtfbins.wtf/) - [Sigma](https://github.com/mthcht/sigma/tree/master/rules) - [Regras Splunk](https://research.splunk.com/detections/) - [Regras Elastic](https://github.com/elastic/detection-rules) - [DFIR-Report Sigma-Rules](https://github.com/The-DFIR-Report/Sigma-Rules) - [JoeSecurity Sigma-Rules](https://github.com/joesecurity/sigma-rules/tree/master/rules) - [mdecrevoisier Sigma-Rules](https://github.com/mdecrevoisier/SIGMA-detection-rules) - [P4T12ICK Sigma-Rules](https://github.com/P4T12ICK/Sigma-Rule-Repository) - [tsale Sigma-Rules](https://github.com/tsale/Sigma_rules) - [lista de recursos de detecção](https://github.com/jatrost/awesome-detection-rules) - [Consultas de Caça KQL](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules) - [recursos de engenharia de detecção](https://github.com/infosecB/awesome-detection-engineering) - [Defender Resource](https://defenderresourcehub.info/) - [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection) --- [Read more](https://github.com/mthcht/awesome-lists)

awesome-lists

Mais Populares

Listas de segurança para detecções de SOC/DFIR

🐾 Threat Hunting: