Listas de segurança para detecções SOC/DFIR

🐾 Threat Hunting:

Pesquisas ThreatHunting

📂 Minhas Listas de Detecção

📋 Listas: https://github.com/mthcht/awesome-lists/tree/main/Lists
🕵️‍♂️ Guias ThreatHunting: https://mthcht.medium.com/list/threat-hunting-708624e9266f
🚰 Named pipes suspeitos: suspicious_named_pipe_list.csv
🌐 TLDs suspeitos (atualizados automaticamente): [suspicious_TLDs]
🌐 ASNs suspeitos (atualizados automaticamente): [suspicious ASNs]
🌐 FYI - Banco de dados Maxmind GeoIP (atualizado automaticamente): GeoIP DB
🆔 IDs de aplicativos OAuth suspeitos: OauthSentry
🔧 Serviços do Windows suspeitos: suspicious_windows_services_names_list.csv
⏲️ Tarefas do Windows suspeitas: suspicious_windows_tasks_list.csv
🚪 Porta de destino suspeita: suspicious_ports_list.csv
🛡️ Regras de firewall suspeitas: suspicious_windows_firewall_rules_list.csv
🆔 User-agent suspeito: suspicious_http_user_agents_list.csv
🔏 Assinante de CERTs suspeito: [suspicious CERTS]
📇 IDs USB suspeitos: suspicious_usb_ids_list.csv
🏷️ Nomes de mutex suspeitos: suspicious_mutex_names_list.csv

Atualizo regularmente a maioria dessas listas após cada ferramenta que analiso no meu projeto detection keywords

Outras Listas

🛡️ DFIR:

🚫 Feeds de IOC/Blacklists:

🐙 Github

Mais listas github

🖥️ Relacionado a SIEM/SOC/PurpleTeam:

- [EDR Telemetry](https://github.com/tsale/EDR-Telemetry) - [PurpleTeam Scripts](https://github.com/mthcht/Purpleteam) - [Awesome-SOC](https://github.com/cyb3rxp/awesome-soc) - [Awesome SOC analyst](https://github.com/st0pp3r/awesome-soc-analyst) - [Caça a ameaças com Splunk](https://github.com/mthcht/ThreatHunting-Keywords) - [Listas de detecção](https://github.com/mthcht/awesome-lists/Lists) - [PurpleTeam atomics](https://github.com/redcanaryco/atomic-red-team)

📊 TI TTP/Framework/Modelo/Rastreadores

🕵️‍♂️ Investigação

📊 Verificações de TI

🔬 Sandbox / Emulação

🧩 Manipulação de dados

📡 Recursos de detecção

🌐 Notícias de segurança

- [Feed do blog Adam Chester](https://blog.xpnsec.com/rss.xml) - [feed de APT da ahnlab](https://asec.ahnlab.com/en/category/apt-en/feed/) - [feed de CERT da ahnlab](https://asec.ahnlab.com/en/category/cert-en/feed) - [feed de phishing da ahnlab](https://asec.ahnlab.com/en/category/phishing-scam-en/feed) - [feed de tendências da ahnlab](https://asec.ahnlab.com/en/category/trend-en/feed) - [feed do blog da Akamai](https://feeds.feedburner.com/akamai/blog) - [feed do blog de análise de malware do Any.run](https://any.run/cybersecurity-blog/category/malware-analysis/feed/) - [feed do blog da Avast](https://blog.avast.com/rss.xml) - [badsectorlabs Última semana em segurança - Redteam](https://blog.badsectorlabs.com/feeds/all.atom.xml) - [feed do blog bi-zone](https://medium.com/feed/@bi-zone) - [feed dos laboratórios da bitdefender](https://www.bitdefender.com/nuxt/api/en-us/rss/labs/) - [feed do blog binarydefense](https://www.binarydefense.com/feed/) - [blog da Blackberry](https://blogs.blackberry.com/en/home) - [Feed do Bleepingcomputer](https://www.bleepingcomputer.com/feed/) - [feed do bleepingcomputer](https://www.bleepingcomputer.com/feed/) - [feed do blog da Broadcom](https://sed-cms.broadcom.com/rss/v1/blogs/rss.xml) - [Alertas do CERT FR](https://www.cert.ssi.gouv.fr/alerte/) - [Avisos do CERT FR](https://www.cert.ssi.gouv.fr/avis/) - [feed do CERT LV](https://cert.lv/en/feed/rss/all) - [feed do CERT PL](https://cert.pl/en/rss.xml) - [feed do CERT SE](https://www.cert.se/feed.rss) - [feed do CERT SI](https://www.cert.si/en/category/news/feed/) - [feed do CERT UA](https://cert.gov.ua/api/articles/rss) - [CERT-FR](https://www.cert.ssi.gouv.fr/) - [feed da Checkpoint Research](https://research.checkpoint.com/feed) - [feed do CIRT bd](https://www.cirt.gov.bd/feed/) - [feed de notícias da CISA](https://www.cisa.gov/cybersecurity-advisories/all.xml) - [notícias da CISA](https://www.cisa.gov/news-events/news) - [Cisco Talos](https://www.talosintelligence.com/) - [pesquisas do claroty team82](https://claroty.com/team82/research/) - [feed de segurança da Cloudfare](https://blog.cloudflare.com/tag/security/rss) - [Feed de Clément Notin](https://clement.notin.org/feed.xml) - [blog de operações contra adversários da crowdstrike](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) - [blog da deepinstinct](https://www.deepinstinct.com/blog) - [detect.fyi](https://detect.fyi/) - [Engenharia de detecção semanal](https://www.detectionengineering.net/) - [Notícias semanais de DFIR](https://thisweekin4n6.com/) - [feed de notícias semanais de DFIR](https://thisweekin4n6.wordpress.com/feed/) - [feed de alertas de vírus da drweb](https://news.drweb.com/rss/get/?c=9) - [inteligência de ameaças da eclecticiq](https://www-eclecticiq-com.sandbox.hs-sites.com/blog?type=intelligence-research#overview) - [blog dos laboratórios de segurança da Elastic](https://www.elastic.co/security-labs) - [feed do blog dos laboratórios de segurança da elastic](https://www.elastic.co/security-labs/rss/feed.xml) - [Blog da EricaZelic](https://ericazelic.medium.com/) - [blog do laboratório da forcepoint](https://www.forcepoint.com/blog/x-labs) - [feed de inteligência de ameaças da genians](https://www.genians.co.kr/blog/threat_intelligence/rss.xml) - [feed de inteligência de ameaças do gi7w0rm](https://medium.com/feed/@gi7w0rm) - [feed do blog do Google Project Zero](https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss) - [feed de inteligência de ameaças do Google](https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v) - [Inteligência de ameaças do Google](https://cloud.google.com/blog/topics/threat-intelligence) - [feed de análise de ameaças do Google](https://blog.google/threat-analysis-group/rss/) - [feed do Group-IB](https://blog.group-ib.com/rss.xml) - [Feed do HackerNews](https://feeds.feedburner.com/TheHackersNews) - [feed do laboratório harfanglab](https://harfanglab.io/insidethelab/feed/) - [feed do blog hexacorn](http://www.hexacorn.com/blog/feed/) - [Feed do horizon3](https://www.horizon3.ai/feed/) - [blog do hunt.io](https://hunt.io/blog) - [feed do blog da Huntress](https://www.huntress.com/blog/rss.xml) - [feed do IC3 CSA](https://www.ic3.gov/CSA/rss) - [Feed de notícias do Infostealers Hub](https://www.infostealers.com/learn-info-stealers/feed/) - [feed de relatórios de infostealers](https://www.infostealers.com/info-stealers-reports/feed/) - [feed da Intrinsec](https://www.intrinsec.com/feed/) - [feed do isc sans edu](https://isc.sans.edu/rssfeed.xml) - [feed do JPCERT](https://blogs.jpcert.or.jp/en/atom.xml) - [JPCERT](https://www.jpcert.or.jp/english/) - [feed do krebsonsecurity](https://krebsonsecurity.com/feed/) - [feed do blog da Malwarebytes](https://www.malwarebytes.com/blog/feed/index.xml) - [feed do malwaretech](https://www.malwaretech.com/feed) - [Blog de Mauricio Velazco](https://medium.com/@mvelazco) - [feed dos laboratórios McAfee](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/feed/) - [Blog de Michael Haag](https://haggis-m.medium.com/) - [feed do blog de segurança da Microsoft](https://www.microsoft.com/en-us/security/blog/feed/) - [hub ninja de resposta a incidentes da Microsoft](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/welcome-to-the-microsoft-incident-response-ninja-hub/4243594) - [feed de inteligência de ameaças da Microsoft](https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed) - [pesquisa de ameaças da morphisec](https://blog.morphisec.com/topic/threat-research) - [feed de pesquisas da NCC Group](https://research.nccgroup.com/feed/) - [blog de pesquisa em segurança da nccgroup](https://www.nccgroup.com/us/research-blog/?resource=18345&category=18146#hub) - [feed de notícias do NCSC](https://feeds.english.ncsc.nl/news.rss) - [CVEs do NIST](https://nvd.nist.gov/vuln/search/results?isCpeNameSearch=false&results_type=overview&form_type=Basic&search_type=all&startIndex=0) - [feed de insights de segurança cibernética do NIST](https://www.nist.gov/blogs/cybersecurity-insights/rss.xml) - [Pesquisa Ofensiva - DSAS da INJECT](https://blog.injectexp.dev/) - [Inteligência da orangecyberdefense](https://www.orangecyberdefense.com/global/blog?tx_solr%5Bfilter%5D%5B0%5D=tags%3AIntelligence-led+Security) - [feed de pesquisa e inteligência de ameaças da outpost24](https://outpost24.com/blog/category/research-and-threat-intel/feed/) - [insights de ameaças da Proofpoint](https://www.proofpoint.com/us/blog/threat-insight#) - [feed de pesquisa de ameaças da Qualys](https://blog.qualys.com/vulnerabilities-threat-research/feed) - [feed do redcanary](https://www.redcanary.co/feed/) - [pesquisa de ameaças da ReversingLabs](https://www.reversinglabs.com/blog/tag/threat-research) - [blog da SANS](https://www.sans.org/blog/) - [inteligência de ameaças da security.com](https://www.security.com/threat-intelligence) - [feed de APT do securityaffairs](https://securityaffairs.com/category/apt/feed) - [feed do SecurityWeek](https://www.securityweek.com/feed/) - [feed de ataques direcionados APT do securlist](https://securelist.com/threat-category/apt-targeted-attacks/feed/) - [Blog da Sekoia](https://blog.sekoia.io/) - [feed do blog da Sekoia](https://blog.sekoia.io/feed/) - [feed dos laboratórios da SentinelOne](https://www.sentinelone.com/labs/feed/) - [blog técnico da seqrite](https://www.seqrite.com/blog/category/technical/) - [feed do blog de Simone Kraus](https://medium.com/feed/@simone.kraus) - [feed de pesquisa de ameaças da Sophos](https://news.sophos.com/en-us/category/threat-research/feed/) - [feed do specterops](https://posts.specterops.io/feed) - [Blog de pesquisa da Splunk](https://www.splunk.com/en_us/blog/author/secmrkt-research.html) - [feed de notícias da Sybersecyrity](https://cybersecuritynews.com/feed/) - [feed do Talos](https://feeds.feedburner.com/feedburner/Talos) - [Blog da Tenable](https://medium.com/tenable-techblog) - [feed do The HackerNews](https://feeds.feedburner.com/TheHackersNews) - [feed do thedfirreport](https://thedfirreport.com/feed/) - [feed do blog da ThreatConnect](https://threatconnect.com/blog/feed/) - [blog do threatlabz da Zscaler](https://threatlabz.zscaler.com/blogs) - [feed do Threatpost](https://threatpost.com/feed/) - [feed de segurança da Trend Micro](http://feeds.trendmicro.com/TrendMicroSimplySecurity) - [feed do blog da Trustwave](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rss.xml) - [Twitter](https://twitter.com/home) - [feed da Unit42](http://feeds.feedburner.com/Unit42) - [feed da Unit42](https://unit42.paloaltonetworks.com/feed/) - [feed do Virus Bulletin](https://www.virusbulletin.com/rss) - [Virus Bulletin](https://www.virusbulletin.com/virusbulletin/) - [feed do blog da Volexity](https://www.volexity.com/blog/feed/) - [feed do WeLiveSecurity](https://www.welivesecurity.com/en/rss/feed/) - [newsletter tl;dr sec](https://tldrsec.com/)

📺 Canais do Youtube/Twitch

🎙️ Podcasts

💬 Canais do Discord /Slack

📚 Treinamento

DFIR

13cubed - Investigando endpoints do Windows 13cubed.com - endpoints do Windows
13cubed - Investigando memória do Windows 13cubed.com - memória do Windows
13cubed - Investigando dispositivos Linux 13cubed.com - linux
SANS: FOR500
SANS: FOR508
Defensive-security: Linux-live-forensics
@0gtweet - Curso de forense: Dominando a Forense do Windows
@DebugPrivilege: Curso gratuito de depuração forense InsightEngineering
Desafios:
- Arsenal Recon Imagens de discos para DFIR: publicly-accessible-disk-images
- @inversecos - Laboratórios de emulação de APT: xintra
- @TheDFIRReport: Laboratórios com logs dos relatórios existentes dfir-labs
- @ACEresponder: Cursos com explicações detalhadas e laboratórios aceresponder.com
- @binaryz0ne: Desafios de DFIR com Datasets + workshop de forense Linux

SOC

📚 Livros

DFIR

📚 Sites de conhecimento

🧪 LAB

📦 Outros

Criação de conteúdo

Criador de animações de ataque - aceresponder

🏷️ Favoritos

⭐ Favoritos com todas as minhas listas para importar no seu navegador (atualizados automaticamente) ATUALIZAR FAVORITOS

awesome-lists

Mais Populares

Ofensivo

Desafios

RE / Análise de Malware / Aprofundamento

SOC

Aprofundamento

Exploração

IA