Списки безопасности для SOC/DFIR-обнаружений

🐾 Охота за угрозами:

Поисковые запросы ThreatHunting

📂 Мои списки обнаружений

📋 Списки: https://github.com/mthcht/awesome-lists/tree/main/Lists
🕵️‍♂️ Руководства ThreatHunting: https://mthcht.medium.com/list/threat-hunting-708624e9266f
🚰 Подозрительные именованные каналы: suspicious_named_pipe_list.csv
🌐 Подозрительные TLD (обновляются автоматически): [suspicious_TLDs]
🌐 Подозрительные ASN (обновляются автоматически): [suspicious ASNs]
🌐 К сведению — база данных Maxmind GeoIP (обновляется автоматически): GeoIP DB
🆔 Подозрительные ID приложений OAuth: OauthSentry
🔧 Подозрительные службы Windows: suspicious_windows_services_names_list.csv
⏲️ Подозрительные задачи Windows: suspicious_windows_tasks_list.csv
🚪 Подозрительные порты назначения: suspicious_ports_list.csv
🛡️ Подозрительные правила брандмауэра: suspicious_windows_firewall_rules_list.csv
🆔 Подозрительные User-Agent: suspicious_http_user_agents_list.csv
🔏 Подозрительные подписанты сертификатов: [подозрительные сертификаты]
📇 Подозрительные USB ID: suspicious_usb_ids_list.csv
🏷️ Подозрительные имена мьютексов:

Я регулярно обновляю большинство этих списков после анализа каждого инструмента в своём проекте detection keywords

Другие списки

🛡️ DFIR:

🚫 Каналы IOC/Чёрные списки:

🐙 Github

Больше списков GitHub

🖥️ Связанное с SIEM/SOC/PurpleTeam:

- [EDR Telemetry](https://github.com/tsale/EDR-Telemetry) - [PurpleTeam Scripts](https://github.com/mthcht/Purpleteam) - [Awesome-SOC](https://github.com/cyb3rxp/awesome-soc) - [Awesome SOC analyst](https://github.com/st0pp3r/awesome-soc-analyst) - [Охота за угрозами с помощью Splunk](https://github.com/mthcht/ThreatHunting-Keywords) - [Списки детектирования](https://github.com/mthcht/awesome-lists/Lists) - [PurpleTeam atomics](https://github.com/redcanaryco/atomic-red-team)

📊 TI TTP/Фреймворки/Модели/Трекеры

🕵️‍♂️ Расследование

📊 Проверки TI

🔬 Песочница / Эмуляция

🧩 Обработка данных

📡 Ресурсы по детектированию

🌐 Новости безопасности

- [Adam Chester Blog Feed](https://blog.xpnsec.com/rss.xml) - [ahnlab apt feed](https://asec.ahnlab.com/en/category/apt-en/feed/) - [ahnlab cert feed](https://asec.ahnlab.com/en/category/cert-en/feed) - [ahnlab phishing feed](https://asec.ahnlab.com/en/category/phishing-scam-en/feed) - [ahnlab trend feed](https://asec.ahnlab.com/en/category/trend-en/feed) - [Akamai blog feed](https://feeds.feedburner.com/akamai/blog) - [Any.run malware analysis blog feed](https://any.run/cybersecurity-blog/category/malware-analysis/feed/) - [Avast Blog feed](https://blog.avast.com/rss.xml) - [badsectorlabs Last week in security - Redteam](https://blog.badsectorlabs.com/feeds/all.atom.xml) - [bi-zone blog feed](https://medium.com/feed/@bi-zone) - [bitdefender labs feed](https://www.bitdefender.com/nuxt/api/en-us/rss/labs/) - [binarydefense blog feed](https://www.binarydefense.com/feed/) - [Blackberry blog](https://blogs.blackberry.com/en/home) - [Bleepingcomputer Feed](https://www.bleepingcomputer.com/feed/) - [bleepingcomputer feed](https://www.bleepingcomputer.com/feed/) - [broadcom blog feed](https://sed-cms.broadcom.com/rss/v1/blogs/rss.xml) - [CERT FR Alerts](https://www.cert.ssi.gouv.fr/alerte/) - [CERT FR Avis](https://www.cert.ssi.gouv.fr/avis/) - [CERT LV feed](https://cert.lv/en/feed/rss/all) - [CERT PL feed](https://cert.pl/en/rss.xml) - [CERT SE feed](https://www.cert.se/feed.rss) - [CERT SI feed](https://www.cert.si/en/category/news/feed/) - [CERT UA feed](https://cert.gov.ua/api/articles/rss) - [CERT-FR](https://www.cert.ssi.gouv.fr/) - [Checkpoint Research feed](https://research.checkpoint.com/feed) - [CIRT bd feed](https://www.cirt.gov.bd/feed/) - [CISA news feed](https://www.cisa.gov/cybersecurity-advisories/all.xml) - [CISA news](https://www.cisa.gov/news-events/news) - [Cisco Talos](https://www.talosintelligence.com/) - [claroty team82 research](https://claroty.com/team82/research/) - [Cloudfare security feed](https://blog.cloudflare.com/tag/security/rss) - [Clément Notin Feed](https://clement.notin.org/feed.xml) - [crowdstrike counter adversary operations blog](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) - [deepinstinct blog](https://www.deepinstinct.com/blog) - [detect.fyi](https://detect.fyi/) - [Detection engineering weekly](https://www.detectionengineering.net/) - [DFIR weekly news](https://thisweekin4n6.com/) - [DFIR weekly news feed](https://thisweekin4n6.wordpress.com/feed/) - [drweb virus alert feed](https://news.drweb.com/rss/get/?c=9) - [eclecticiq threat intel](https://www-eclecticiq-com.sandbox.hs-sites.com/blog?type=intelligence-research#overview) - [Elastic security labs blog](https://www.elastic.co/security-labs) - [elastic security labs blog feed](https://www.elastic.co/security-labs/rss/feed.xml) - [EricaZelic Blog](https://ericazelic.medium.com/) - [forcepoint lab blog](https://www.forcepoint.com/blog/x-labs) - [genians threat intel feed](https://www.genians.co.kr/blog/threat_intelligence/rss.xml) - [gi7w0rm threat intel feed](https://medium.com/feed/@gi7w0rm) - [Google Project Zero blog feed](https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss) - [Google threat intelligence feed](https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v) - [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence) - [Google Threat analysis feed](https://blog.google/threat-analysis-group/rss/) - [Group-IB feed](https://blog.group-ib.com/rss.xml) - [HackerNews Feed](https://feeds.feedburner.com/TheHackersNews) - [harfanglab lab feed](https://harfanglab.io/insidethelab/feed/) - [hexacorn blog feed](http://www.hexacorn.com/blog/feed/) - [horizon3 Feed](https://www.horizon3.ai/feed/) - [hunt.io blog](https://hunt.io/blog) - [huntress blog feed](https://www.huntress.com/blog/rss.xml) - [IC3 CSA feed](https://www.ic3.gov/CSA/rss) - [Infostealers Hub News Feed](https://www.infostealers.com/learn-info-stealers/feed/) - [infostealers reports feed](https://www.infostealers.com/info-stealers-reports/feed/) - [Intrinsec feed](https://www.intrinsec.com/feed/) - [isc sans edu feed](https://isc.sans.edu/rssfeed.xml) - [JPCERT feed](https://blogs.jpcert.or.jp/en/atom.xml) - [JPCERT](https://www.jpcert.or.jp/english/) - [krebsonsecurity feed](https://krebsonsecurity.com/feed/) - [malwarebytes blog feed](https://www.malwarebytes.com/blog/feed/index.xml) - [malwaretech feed](https://www.malwaretech.com/feed) - [Mauricio Velazco Blog](https://medium.com/@mvelazco) - [mcafee labs feed](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/feed/) - [Michael Haag Blog](https://haggis-m.medium.com/) - [Microsoft security blog feed](https://www.microsoft.com/en-us/security/blog/feed/) - [Microsoft Incident response ninja hub](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/welcome-to-the-microsoft-incident-response-ninja-hub/4243594) - [Microsoft Threat Intel feed](https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed) - [morphisec threat research](https://blog.morphisec.com/topic/threat-research) - [NCC Group research feed](https://research.nccgroup.com/feed/) - [nccgroup research blog security](https://www.nccgroup.com/us/research-blog/?resource=18345&category=18146#hub) - [NCSC news feed](https://feeds.english.ncsc.nl/news.rss) - [NIST CVEs](https://nvd.nist.gov/vuln/search/results?isCpeNameSearch=false&results_type=overview&form_type=Basic&search_type=all&startIndex=0) - [NIST cybersecurity insights feed](https://www.nist.gov/blogs/cybersecurity-insights/rss.xml) - [Offensive Research - DSAS by INJECT](https://blog.injectexp.dev/) - [orangecyberdefense Intel](https://www.orangecyberdefense.com/global/blog?tx_solr%5Bfilter%5D%5B0%5D=tags%3AIntelligence-led+Security) - [outpost24 research and threat intel feed](https://outpost24.com/blog/category/research-and-threat-intel/feed/) - [proofpoint threat insight](https://www.proofpoint.com/us/blog/threat-insight#) - [Qualys Threat research feed](https://blog.qualys.com/vulnerabilities-threat-research/feed) - [redcanary feed](https://www.redcanary.co/feed/) - [reversinglabs threat research](https://www.reversinglabs.com/blog/tag/threat-research) - [sans blog](https://www.sans.org/blog/) - [security.com threat intel](https://www.security.com/threat-intelligence) - [securityaffairs apt feed](https://securityaffairs.com/category/apt/feed) - [securityweek feed](https://www.securityweek.com/feed/) - [securlist apt targeted attacks feed](https://securelist.com/threat-category/apt-targeted-attacks/feed/) - [Sekoia Blog](https://blog.sekoia.io/) - [Sekoia blog feed](https://blog.sekoia.io/feed/) - [SentinelOne labs feed](https://www.sentinelone.com/labs/feed/) - [seqrite techical blog](https://www.seqrite.com/blog/category/technical/) - [Simone Kraus blog feed](https://medium.com/feed/@simone.kraus) - [sophos threat research feed](https://news.sophos.com/en-us/category/threat-research/feed/) - [specterops feed](https://posts.specterops.io/feed) - [Splunk Research Blog](https://www.splunk.com/en_us/blog/author/secmrkt-research.html) - [Sybersecyrity news feed](https://cybersecuritynews.com/feed/) - [Talos feed](https://feeds.feedburner.com/feedburner/Talos) - [tenable Blog](https://medium.com/tenable-techblog) - [The HackerNews feed](https://feeds.feedburner.com/TheHackersNews) - [thedfirreport feed](https://thedfirreport.com/feed/) - [threat connect blog feed](https://threatconnect.com/blog/feed/) - [threatlabz zscaler blog](https://threatlabz.zscaler.com/blogs) - [threatpost feed](https://threatpost.com/feed/) - [trendmicro security feed](http://feeds.trendmicro.com/TrendMicroSimplySecurity) - [Trustwave blog feed](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rss.xml) - [Twitter](https://twitter.com/home) - [Unit42 feed](http://feeds.feedburner.com/Unit42) - [Unit42 feed](https://unit42.paloaltonetworks.com/feed/) - [virusbulletin feed](https://www.virusbulletin.com/rss) - [virusbulletin](https://www.virusbulletin.com/virusbulletin/) - [volexity blog feed](https://www.volexity.com/blog/feed/) - [welivesecurity feed](https://www.welivesecurity.com/en/rss/feed/) - [tl;dr sec newsletter](https://tldrsec.com/)

📺 YouTube/Twitch-каналы

🎙️ Подкасты

💬 Discord /Slack-каналы

📚 Обучение

DFIR

13cubed - Investigating Windows Endpoints 13cubed.com -windows endpoints
13cubed - Investigating Windows Memory 13cubed.com -windows memory
13cubed - Investigating Linux Devices 13cubed.com - linux
SANS: FOR500
SANS: FOR508
Defensive-security: Linux-live-forensics
@0gtweet - Forensic course: Mastering Windows Forensics
@DebugPrivilege : Forensic Debugging free course InsightEngineering
Challenges:
- Arsenal Recon Disks Images for DFIR: publicly-accessible-disk-images
- @inversecos - APT Emulation Labs: xintra
- @TheDFIRReport : LABs with logs from the existing reports dfir-labs
- @ACEresponder: Courses with Detailed Explanations and Labs aceresponder.com
- @binaryz0ne: DFIR challenges with Datasets + Linux forensic workshop

SOC

📚 Книги

DFIR

📚 База знаний

🧪 Лаборатория

📦 Прочее

Создание контента

Создатель анимаций атак — aceresponder

🏷️ Закладки

⭐ Закладки со всеми моими списками для импорта в ваш браузер (обновляются автоматически) ОБНОВИТЬ ЗАКЛАДКИ

awesome-lists

Популярное

Offensive

Challenges

RE / Malware Analysis / Deep Dive

SOC

Глубокое погружение

Эксплуатация

AI