# Списки безопасности для SOC/DFIR-обнаружений [![Awesome](https://awesome.re/badge.svg)](https://awesome.re) ![dt](https://assets.kitploit.com/production/public/readmes/43141/1ca7331d54b144e54b976c78292994375aa0ce385c1551f725dc5a28074c9307.jpg) ## 🐾 Охота за угрозами: - [Сайт ThreatHunting keywords](https://mthcht.github.io/ThreatHunting-Keywords/) - [Списки ThreatHunting keywords](https://github.com/mthcht/ThreatHunting-Keywords) - [Yara-правила ThreatHunting](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) [Поисковые запросы ThreatHunting](https://github.com/mthcht/Purpleteam/tree/main/Detection/Threat%20Hunting/generic)

- [Поисковые запросы по службам Windows](https://detect.fyi/threat-hunting-suspicious-windows-service-names-2f0dceea204c) - [Поисковые запросы по User-Agents](https://mthcht.medium.com/threat-hunting-suspicious-user-agents-3dd764470bd0) - [Поисковые запросы по DNS Over HTTPS](https://mthcht.medium.com/detecting-dns-over-https-30fddb55ac78) - [Поисковые запросы по подозрительным TLD](https://mthcht.medium.com/threat-hunting-suspicious-tlds-a742c2adbf58) - [Поисковые запросы по HijackLibs](https://mthcht.medium.com/detect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f) - [Поисковые запросы по фишингу и DNSTWIST](https://detect.fyi/detecting-phishing-attempts-with-dnstwist-37c426b3bbb8) - [Поисковые запросы по расширениям браузеров](https://mthcht.medium.com/detecting-browser-extensions-installations-e0ac2b45c46b) - [C2, скрывающийся на виду](https://mthcht.medium.com/c2-hiding-in-plain-sight-7a83963b9344) - [Артефакты HTML-смаглинга](https://mthcht.medium.com/detecting-html-smuggling-phishing-attempts-15af824e60e4) - [Поисковые запросы по PsExec и аналогичным инструментам](https://mthcht.medium.com/detecting-psexec-and-similar-tools-c812bf3dca6c) - [Выявление Time Slipping](https://mthcht.medium.com/event-log-manipulations-1-time-slipping-55bf95631c40) - [Подозрительные именованные каналы](https://detect.fyi/threat-hunting-suspicious-named-pipes-a4206e8a4bc8)

## 📂 Мои списки обнаружений - 📋 Списки: https://github.com/mthcht/awesome-lists/tree/main/Lists - 🕵️‍♂️ Руководства ThreatHunting: https://mthcht.medium.com/list/threat-hunting-708624e9266f - 🚰 Подозрительные именованные каналы: [suspicious_named_pipe_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_named_pipe_list.csv) - 🌐 Подозрительные TLD (обновляются автоматически): [[suspicious_TLDs]](https://github.com/mthcht/awesome-lists/tree/main/Lists/TLDs) - 🌐 Подозрительные ASN (обновляются автоматически): [[suspicious ASNs]](https://github.com/mthcht/awesome-lists/tree/main/Lists/ASNs) - 🌐 К сведению — база данных Maxmind GeoIP (обновляется автоматически): [GeoIP DB](https://github.com/mthcht/awesome-lists/tree/main/Lists/ASNs/correlation_maxmind_geo_db/maxmind_databases/extracted) - 🆔 Подозрительные ID приложений OAuth: [OauthSentry](https://oauthsentry.github.io/) - 🔧 Подозрительные службы Windows: [suspicious_windows_services_names_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_services_names_list.csv) - ⏲️ Подозрительные задачи Windows: [suspicious_windows_tasks_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv) - 🚪 Подозрительные порты назначения: [suspicious_ports_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_ports_list.csv) - 🛡️ Подозрительные правила брандмауэра: [suspicious_windows_firewall_rules_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_firewall_rules_list.csv) - 🆔 Подозрительные User-Agent: [suspicious_http_user_agents_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv) - 🔏 Подозрительные подписанты сертификатов: [\[подозрительные сертификаты\]](https://github.com/mthcht/awesome-lists/tree/main/Lists/CERTS) - 📇 Подозрительные USB ID: [suspicious_usb_ids_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_usb_ids_list.csv) - 🏷️ Подозрительные имена мьютексов: [suspicious_mutex_names_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_mutex_names_list.csv) - 🔢 Подозрительные MAC-адреса: [suspicious_mac_address_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_mac_address_list.csv) - 📛 Подозрительные имена хостов: [suspicious_hostnames_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_hostnames_list.csv) - 🌐 Подозрительные расширения браузеров: [Расширения браузеров](https://github.com/mthcht/awesome-lists/tree/main/Lists/Browser%20Extensions) - 📧 Список ID приложений Microsoft - обнаружение BEC [microsoft_apps_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/microsoft_apps_list.csv) - 🧮 Метаданные исполняемых файлов: [executables_metadata_informations_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Windows%20Metadata/executables_metadata_informations_list.csv) - 🕸️ Список серверов DNS over HTTPS: [dns_over_https_servers_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/dns_over_https_servers_list.csv) - 🕸️ Список доменов Dynamic DNS: [dyndns_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/DYNDNS/dyndns_list.csv) - 🪝 Списки фишинга: [Фишинговые домены и URL](https://github.com/mthcht/awesome-lists/tree/main/Lists/Phishing) - 🕸️ Домены : [\[синкхоленные серверы\]](https://github.com/mthcht/awesome-lists/tree/main/Lists/Domains) - 🕳️ Синкхоленные домены : [sinkholed_domains.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Domains/sinkholed_servers/sinkholed_domains.csv) - 🕳️ Сайт Sinkholed: [SINKHOLED](https://github.com/sinkholed/sinkholed.github.io) - 📚 Hijacklibs (обновляется автоматически): [hijacklibs_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Hijacklibs/hijacklibs_list.csv) - 🌐 Списки узлов TOR (обновляются автоматически): [[TOR]](https://github.com/mthcht/awesome-lists/tree/main/Lists/TOR) - 🛠️ Список LOLDriver (обновляется автоматически): [loldrivers_only_hashes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Drivers/loldrivers_only_hashes_list.csv) - 🛠️ Список вредоносных загрузчиков (обновляется автоматически): [malicious_bootloaders_only_hashes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/Drivers/malicious_bootloaders_only_hashes_list.csv) - 📜 Список вредоносных SSL-сертификатов (обновляется автоматически): [ssl_certificates_malicious_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/SSL%20CERTS/ssl_certificates_malicious_list.csv) - 🖥️ Обнаружение RMM: [[RMM]](https://github.com/mthcht/awesome-lists/tree/main/Lists/RMM) - 👤🔑 Важные роли, группы и разрешения для AD/EntraID/AWS/Graph: [[permissions]](https://github.com/mthcht/awesome-lists/tree/main/Lists/permissions) - 💻🔒 Известные расширения файлов программ-вымогателей: [ransomware_extensions_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/ransomware_extensions_list.csv) - 💻🔒 Известные имена файлов записок с требованием выкупа: [ransomware_notes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/ransomware_notes_list.csv) - 📝 Правила ASR для Windows: [windows_asr_rules.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/windows_asr_rules.csv) - 🌐 Списки DNSTWIST (обновляются автоматически): [Домены по умолчанию DNSTWIST + скрипт](https://github.com/mthcht/awesome-lists/tree/main/Lists/Phishing/DNSTWIST) - 🌍 VPN [Списки IP-адресов](https://github.com/mthcht/awesome-lists/tree/main/Lists/VPN) (обновляются автоматически): - 🛡️ NordVPN: [nordvpn_ips_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/NordVPN/nordvpn_ips_list.csv) - 🛡️ ProtonVPN: [protonvpn_ip_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/ProtonVPN/protonvpn_ip_list.csv) - 🛡️ SurfShark: [surfshark_vpn_servers_domains_and_ips_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/SurfSharkVPN/surfshark_vpn_servers_domains_and_ips_list.csv) - 🛡️ MullVad: [mullvad_relay_servers_ips_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/MullVad/mullvad_relay_servers_ips_list.csv) - 🌍 Прокси [Списки IP/портов прокси](https://github.com/mthcht/awesome-lists/tree/main/Lists/PROXY) - 🏢 Списки IP-диапазонов компаний (обновляются автоматически): [Списки по умолчанию + скрипт](https://github.com/mthcht/awesome-lists/tree/main/Lists/Ranges_IP_Address_Company_List/bgp.he.net) / [Microsoft](https://github.com/mthcht/awesome-lists/tree/main/Lists/Ranges_IP_Address_Company_List/Microsoft) - 📍 Списки GeoIP-сервисов: [ip_location_sites_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/GeoIP/ip_location_sites_list.csv) - 🧬 Yara-правила: [Threat Hunting yara rules](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) - 🧬 Паттерны обнаружения атакующих инструментов: [offensive_tool_keywords.csv](https://raw.githubusercontent.com/mthcht/ThreatHunting-Keywords/main/offensive_tool_keyword.csv) - 🧬 Паттерны обнаружения greyware-инструментов: [greyware_tool_keyword.csv](https://raw.githubusercontent.com/mthcht/ThreatHunting-Keywords/main/greyware_tool_keyword.csv) - 🧬 Ключевые слова антивирусных сигнатур: [signature_keyword.csv](https://github.com/mthcht/ThreatHunting-Keywords/blob/main/signature_keyword.csv) - 🧬 Списки антивирусных сигнатур Microsoft Defender: [[Defender]](https://github.com/mthcht/awesome-lists/tree/main/Lists/AV%20signatures/Defender) + [yara](https://github.com/mthcht/awesome-lists/tree/main/Lists/Others/Defender_yara_rules) - 🧬 Списки сигнатур ClamAV: [[ClamAV]](https://github.com/mthcht/awesome-lists/tree/main/Lists/AV%20signatures/ClamAV) - 🔗 Другие корреляционные списки: [[Others]](https://github.com/mthcht/awesome-lists/tree/main/Lists/Others) - 🆔 Списки подозрительных расширений VSCODE: [vsxsentry](https://vsxsentry.github.io/#feed) - 🆔 Списки подозрительных расширений браузеров: [extsentry](https://extsentry.github.io/#feeds/malicious) Я регулярно обновляю большинство этих списков после анализа каждого инструмента в своём проекте [detection keywords](https://github.com/mthcht/ThreatHunting-Keywords) ## Другие списки ### 🛡️ DFIR:

- [🔥 Инструменты EricZimmerman 🔥](https://ericzimmerman.github.io/#!index.md) - [usnjrnl_rewind](https://github.com/CyberCX-DFIR/usnjrnl_rewind) - [dfir-orc](https://github.com/dfir-orc) - [dfir-orc-config](https://github.com/DFIR-ORC/dfir-orc-config) - [Форензические инструменты Arsenal Recon](https://arsenalrecon.com/downloads) - [Splunk4DFIR](https://github.com/mf1d3l/Splunk4DFIR) - [dfiq](https://github.com/google/dfiq) - [Интеллект-карты](https://github.com/AndrewRathbun/DFIRMindMaps) - [Список артефактов - DFIRArtifactMuseum](https://github.com/AndrewRathbun/DFIRArtifactMuseum) - [Список артефактов - ForensicArtifacts](https://github.com/ForensicArtifacts/artifacts) - [Autopsy](https://www.autopsy.com/download/) - [SleuthKit](https://github.com/sleuthkit/sleuthkit) - [\[ОС\] SIFT Workstation](https://www.sans.org/tools/sift-workstation/) - [\[ОС\] Remnux](https://remnux.org/) - [\[ОС\] sof-elk](https://github.com/philhagen/sof-elk) - [\[ОС\] tsurugi](https://tsurugi-linux.org/) - [\[ОС\] DEFT](https://distrowatch.com/table.php?distribution=deft) - [\[ОС\] Flare VM](https://github.com/mandiant/flare-vm) - [PSBits](https://github.com/gtworek/PSBits/tree/master/DFIR) - [Yara - Threat Hunting](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) + [TH](https://github.com/mthcht/ThreatHunting-Keywords) - [Yara - Forge](https://github.com/YARAHQ/yara-forge) - [capa](https://github.com/mandiant/capa) - [Malcontent](https://github.com/chainguard-dev/malcontent) - [\[Парсер событий\] evtx](https://github.com/omerbenamram/evtx) - [\[Парсер событий\] procmon-parser](https://github.com/eronnen/procmon-parser) - [\[Парсер событий\] Linux - MasterParser](https://github.com/securityjoes/MasterParser) - [\[EVTX\] Hayabusa](https://github.com/Yamato-Security/hayabusa) - [\[EVTX\] WELA](https://github.com/Yamato-Security/WELA) - [\[EVTX\] chainsaw](https://github.com/WithSecureLabs/chainsaw) - [\[EVTX\] APTHunter](https://github.com/ahmedkhlief/APT-Hunter/) - [\[EVTX / Auditd\] Zircolite](https://github.com/wagga40/Zircolite) - [werejugo](https://github.com/MarkBaggett/werejugo) - [srum-dump](https://github.com/MarkBaggett/srum-dump) - [ADTimeline](https://github.com/ANSSI-FR/ADTimeline) - [PersistenceSniper](https://github.com/last-byte/PersistenceSniper) - [\[O365\] Журналы - Microsoft-Analyzer-Suite](https://github.com/evild3ad/Microsoft-Analyzer-Suite) - [Logon Tracer](https://github.com/JPCERTCC/LogonTracer) - [Timeline Plaso](https://github.com/log2timeline/plaso) - [Timeline TimeSketch](https://github.com/google/timesketch) - [regripper](https://github.com/warewolf/regripper) - [Сборщик артефактов OneDrive OCR DB (exe)](https://github.com/vxunderground/OCRMe/) - [Сборщик артефактов OneDrive OCR DB (python) ](https://github.com/Beercow/OCRMe) - [hollows hunter](https://github.com/hasherezade/hollows_hunter) - [PE sieve](https://github.com/hasherezade/pe-sieve) - [RdpCacheStitcher](https://github.com/BSI-Bund/RdpCacheStitcher) - [Поиск строк - ripgrep](https://github.com/BurntSushi/ripgrep) - [Поиск строк - Recoll](https://www.recoll.org/pages/recoll-windows.html) - [Kape](https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape) - [Kape Files](https://github.com/EricZimmerman/KapeFiles) - [Больше ресурсов Kape](https://github.com/AndrewRathbun/Awesome-KAPE) - [VolatileDataCollector](https://github.com/gtworek/VolatileDataCollector) - [Velociraptor](https://github.com/Velocidex/velociraptor) - [TZ tools](https://www.tzworks.com/download_links.php) - [Nirsoft tools](https://www.nirsoft.net/) - [\[память\] MemDump](https://nircmd.nirsoft.net/memdump.html) - [\[память\] MemProcFS](https://github.com/ufrisk/MemProcFS) - [\[память\] MemProcFS-Analyzer](https://github.com/LETHAL-FORENSICS/MemProcFS-Analyzer) - [\[память\] avml](https://github.com/microsoft/avml) - [\[память\] WinPmem](https://github.com/Velocidex/WinPmem) - [\[память\] Volatility](https://github.com/volatilityfoundation/volatility3/) - [\[Монтирование образов\] FTK Imager](https://www.exterro.com/ftk-product-downloads) - [\[Монтирование образов\] OSFMount](https://www.osforensics.com/tools/mount-disk-images.html) - [\[Сеть\] Network Miner](https://www.netresec.com/?page=NetworkMiner) - [\[Сеть\] Wireshark](https://www.wireshark.org/) - [\[Сеть\] xplico](https://www.xplico.org/) - [\[Карвинг\] PhotoRec](https://www.cgsecurity.org/wiki/PhotoRec) - [\[Карвинг\] Bulk Extractor](https://github.com/simsong/bulk_extractor) - [Инструменты Didier Stevens](https://blog.didierstevens.com/programs/) - [\[память\] Lime](https://github.com/504ensicsLabs/LiME) - [Артефакты Windows](https://github.com/Psmths/windows-forensic-artifacts) - [\[Linux\] UAC](https://github.com/tclahr/uac) - [\[Linux\] EXT4 / XFS - fjta](https://github.com/mnrkbys/fjta) - [списки - aboutdfir.com](https://aboutdfir.com/) - [Мониторинг - Osquery](https://github.com/osquery/osquery) - [\[Руководство по IR\] OpenProject ](https://github.com/DebugPrivilege/OpenProject) - [\[Инструменты для OSX\] Knockknock](objective-see.com/products/knockknock.html) - [\[Инструменты для OSX\] mac_apt](https://github.com/ydkhatri/mac_apt) - [DNS-форензика расширений браузера Chrome](https://github.com/arsolutioner/ExtensionHound)

### 🚫 Каналы IOC/Чёрные списки:

- [ABUSE.CH BLACKLISTS](https://sslbl.abuse.ch/blacklist/) - [Блок-списки](https://github.com/blocklistproject/Lists) - [Блок-список DNS](https://github.com/hagezi/dns-blocklists) - [Блок-список фишинга](https://github.com/jarelllama/Scam-Blocklist) - [Binary Defense IP Block List](https://www.binarydefense.com/banlist.txt) - [C2IntelFeeds](https://github.com/drb-ra/C2IntelFeeds) - [Volexity TI](https://github.com/volexity/threat-intel) - [Open Source TI](https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds) - [C2 Tracker](https://github.com/montysecurity/C2-Tracker) - [Unit42 IOC](https://github.com/mthcht/iocs) - [Sekoia IOC](https://github.com/SEKOIA-IO/Community/tree/main/IOCs) - [Unit42 Timely IOC](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel) - [Unit42 Articles IOC](https://github.com/PaloAltoNetworks/Unit42-Threat-Intelligence-Article-Information) - [ThreatFOX IOC](https://threatfox.abuse.ch/export/) - [Zscaler ThreatLabz IOC](https://github.com/threatlabz/iocs) - [Записки Zscaler ThreatLabz по ransomware](https://github.com/ThreatLabz/ransomware_notes) - [experiant.ca](https://fsrm.experiant.ca/api/v1/get]) - [Sophos lab IOC](https://github.com/sophoslabs/IoCs) - [ESET Research IOC](https://github.com/eset/malware-ioc) - [ExecuteMalware IOC](https://github.com/executemalware/Malware-IOCs) - [Cisco Talos IOC](https://github.com/Cisco-Talos/IOCs) - [Elastic Lab IOC](https://github.com/elastic/labs-releases/tree/main/indicators) - [Blackorbid APT Report IOC](https://github.com/blackorbird/APT_REPORT) - [AVAST IOC](https://github.com/avast/ioc) - [Zimperium IOC](https://github.com/Zimperium/IOC) - [HarfangLab IOC](https://github.com/HarfangLab/iocs) - [DoctorWeb IOC](https://github.com/DoctorWebLtd/malware-iocs) - [BlackLotusLab IOC](https://github.com/blacklotuslabs/IOCs) - [prodaft IOC](https://github.com/prodaft/malware-ioc) - [Pr0xylife DarkGate IOC](https://github.com/pr0xylife/DarkGate) - [Pr0xylife Latrodectus IOC](https://github.com/pr0xylife/Latrodectus) - [Pr0xylife WikiLoader IOC](https://github.com/pr0xylife/WikiLoader) - [Pr0xylife SSLoad IOC](https://github.com/pr0xylife/SSLoad) - [Pr0xylife Pikabot IOC](https://github.com/pr0xylife/Pikabot) - [Pr0xylife Matanbuchus IOC](https://github.com/pr0xylife/Matanbuchus) - [Pr0xylife QakBot IOC](https://github.com/pr0xylife/Qakbot) - [Pr0xylife IceID IOC](https://github.com/pr0xylife/IcedID) - [Pr0xylife Emotet IOC](https://github.com/pr0xylife/Emotet) - [Pr0xylife BumbleBee IOC](https://github.com/pr0xylife/Bumblebee) - [Pr0xylife Gozi IOC](https://github.com/pr0xylife/Gozi) - [Pr0xylife NanoCore IOC](https://github.com/pr0xylife/Nanocore) - [Pr0xylife NetWire IOC](https://github.com/pr0xylife/Netwire) - [Pr0xylife AsyncRAT IOC](https://github.com/pr0xylife/AsyncRAT) - [Pr0xylife Lokibot IOC](https://github.com/pr0xylife/Lokibot) - [Pr0xylife RemcosRAT IOC](https://github.com/pr0xylife/RemcosRAT) - [Pr0xylife nworm IOC](https://github.com/pr0xylife/nworm) - [Pr0xylife AZORult IOC](https://github.com/pr0xylife/AZORult) - [Pr0xylife NetSupportRAT IOC](https://github.com/pr0xylife/NetSupportRAT) - [Pr0xylife BitRAT IOC](https://github.com/pr0xylife/BitRAT) - [Pr0xylife BazarLoader IOC](https://github.com/pr0xylife/BazarLoader) - [Pr0xylife SnakeKeylogger IOC](https://github.com/pr0xylife/SnakeKeylogger) - [Pr0xylife njRat IOC](https://github.com/pr0xylife/njRat) - [Pr0xylife Vidar IOC](https://github.com/pr0xylife/Vidar) - [Pr0xylife Warmcookie IOC](https://github.com/pr0xylife/Warmcookie-Badspace) - [Cloud Intel IOC](https://github.com/unknownhad/CloudIntel) - [Фишинговые URL - лента за последнюю неделю](https://file.jeroengui.be/phishing/last_week.txt) - [SpamHaus drop.txt](https://www.spamhaus.org/drop/drop.txt) - [SpamHaus drop + ASN](https://www.spamhaus.org/blocklists/do-not-route-or-peer/) - [UrlHaus_misp](https://urlhaus.abuse.ch/downloads/misp/) - [UrlHaus_misp ASN](https://urlhaus.abuse.ch/feeds/) - [UrlHaus](https://urlhaus.abuse.ch/api/#csv) - [vx-underground - Отличный ресурс для образцов и разведотчётов](https://vx-underground.org/Samples) - [Ransomware.live](https://ransomware.live) - [публичная лента отчётов rosti.bin](https://rosti.bin.re/feeds)

### 🐙 Github

- [Больше списков GitHub](https://github.com/mthcht?tab=stars&user_lists_direction=asc&user_lists_sort=name)

### 🖥️ Связанное с SIEM/SOC/PurpleTeam:

- [EDR Telemetry](https://github.com/tsale/EDR-Telemetry) - [PurpleTeam Scripts](https://github.com/mthcht/Purpleteam) - [Awesome-SOC](https://github.com/cyb3rxp/awesome-soc) - [Awesome SOC analyst](https://github.com/st0pp3r/awesome-soc-analyst) - [Охота за угрозами с помощью Splunk](https://github.com/mthcht/ThreatHunting-Keywords) - [Списки детектирования](https://github.com/mthcht/awesome-lists/Lists) - [PurpleTeam atomics](https://github.com/redcanaryco/atomic-red-team)

### 📊 TI TTP/Фреймворки/Модели/Трекеры

- [Инструменты, используемые группами программ-вымогателей - @BushidoToken](https://github.com/BushidoUK/Ransomware-Tool-Matrix) - [Инструменты, используемые российскими APT-группами](https://github.com/BushidoUK/Russian-APT-Tool-Matrix) - [Инструменты, связанные с группами (частично)](https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU) - [Техники - MITRE ATT&CK](https://attack.mitre.org/techniques/enterprise/) - [Тактики - MITRE ATT&CK](https://attack.mitre.org/tactics/enterprise/) - [Матрица соглашений об именовании групп и операций](https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU) - [Меры по смягчению - MITRE ATT&CK](https://attack.mitre.org/mitigations/enterprise/) - [Навигатор по матрице ATT&CK](https://mitre-attack.github.io/attack-navigator/) - [Все данные MITRE в формате xlsx](https://attack.mitre.org/resources/attack-data-and-tools/) - [Инструменты, используемые группами злоумышленников - MITRE ATT&CK](https://attack.mitre.org/software/) - [atomic-red-team](https://github.com/redcanaryco/atomic-red-team) - [Отчёт redcanary об обнаружении угроз](https://redcanary.com/threat-detection-report/) - [The-Unified-Kill-Chain](https://www.unifiedkillchain.com/assets/The-Unified-Kill-Chain.pdf) - [Пирамида TTP](https://scythe.io/library/summiting-the-pyramid-of-pain-the-ttp-pyramid) - [Пирамида боли](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - [Cyber Kill chain](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html) - [MITRE D3FEND](https://d3fend.mitre.org/) - [MITRE CAPEC](https://capec.mitre.org/) - [MITRE CAR](https://car.mitre.org/) - [MITRE DeTTECT](https://github.com/rabobank-cdc/DeTTECT) - [Техники MITRE PRE-ATT&CK](https://attack.mitre.org/versions/v7/techniques/pre/) - [APTMAP](https://github.com/andreacristaldi/APTmap) - [База данных уязвимостей CVE](https://cve.mitre.org/) - [Фреймворк оценки уязвимостей CVE](https://github.com/CERTCC/SSVC) - [Фреймворк REACT](https://atc-project.github.io/react-navigator/) - [🔥ВСЕ ОТЧЁТЫ TI🔥](https://github.com/mthcht/ThreatIntel-Reports) - [🔥Поиск по всем отчётам TI🔥](https://mthcht.github.io/ThreatIntel-Reports/)

### 🕵️‍♂️ Расследование #### 📊 Проверки TI

- [Virustotal](https://www.virustotal.com/#/home/search) - [SpamHaus](https://check.spamhaus.org/) - [app.spur.us](https://app.spur.us/) - [AbuseIPDB](https://www.abuseipdb.com/) - [Telegram BOT хантинг](https://matkap.cti.monster/) - [Malwarebazaar](https://bazaar.abuse.ch/) - [emailrep](https://emailrep.io/) - [dnsdumpster](https://dnsdumpster.com/) - [nslookup.io](https://www.nslookup.io/) - [cloudfare сканирование URL](https://radar.cloudflare.com/scan) - [Проверка IP прокси - proxycheck.io](https://proxycheck.io/web/) - [Проверка репутации IP criminalip](https://www.criminalip.io/en) - [Проверка IP прокси - iphub.info](https://iphub.info/) - [shodan](https://www.shodan.io/) - [Onyphe](https://www.onyphe.io/) - [haveibeenpwned](https://haveibeenpwned.com/) - [leakcheck.io](https://github.com/mthcht/awesome-lists/blob/main/leakcheck.io) - [Censys](https://search.censys.io/) - [cybergordon (проверка репутации URL)](https://cybergordon.com/) - [threatminer](https://www.threatminer.org/) - [urlscan](https://urlscan.io/) - [Apptotal (анализ приложений и расширений)](https://apptotal.io/) - [urlquery](http://urlquery.net/) - [cloudfare scanner](https://radar.cloudflare.com/) - [scamsearch.io](https://scamsearch.io/#anchorCeckNow) - [scamdb.net](https://www.scamdb.net/) - [urlvoid](https://www.urlvoid.com) - [urldna.io](https://urldna.io/) - [url checkphish](https://checkphish.bolster.ai/) - [ipvoid](https://www.ipvoid.com/) - [mxtoolbox](https://mxtoolbox.com/NetworkTools.aspx) - [Заголовки писем mxtoolbox](https://mxtoolbox.com/EmailHeaders.aspx) - [Microsoft TI](https://ti.defender.microsoft.com/) - [pulsedive](https://pulsedive.com/) - [Проверка редиректов URL](https://redirect-checker.net/) - [threatbook](https://threatbook.io/) - [Веб-архив](https://web.archive.org/) - [McAfee Threat Intelligence Exchange](https://www.mcafee.com/enterprise/en-us/products/threat-intelligence-exchange.html) - [Kaspersky Security Network](https://www.kaspersky.com/security-network) - [Microsoft Security Intelligence Report](https://www.microsoft.com/en-us/wdsi/intelligence-report) - [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) - [AlienVault OTX](https://otx.alienvault.com/) - [greynoise](https://viz.greynoise.io/) - [whoxy](https://www.whoxy.com/reverse-whois/) - [url tiny-scan](https://www.tiny-scan.com/) - [сертификаты - crt.sh](https://crt.sh/) - [Проверка сайта - web-check](https://web-check.as93.net/) - [validin.com](https://app.validin.com/) - [Проверка CRX-расширений браузера](https://crxaminer.tech/) - [.EXE поиск - echotrail](https://www.echotrail.io/) - [Malware-Traffic-Analysis (файлы PCAP)](https://malware-traffic-analysis.net/) - [redhuntlabs](https://redhuntlabs.com/online-ide-search) - [whois domaintools](https://whois.domaintools.com/) - [Проверка ASN bgp.he](https://github.com/mthcht/awesome-lists/blob/main/bgp.he.net) - [viewdns](http://viewdns.info/) - [Поиск MAC-адреса по OUI](https://www.wireshark.org/tools/oui-lookup.html) - [macvendorlookup](https://www.macvendorlookup.com/) - [.EXE поиск - xcyclopedia](https://strontic.github.io/xcyclopedia/) - [abuse.ch](https://abuse.ch/#platforms) - [malware-traffic-analysis](https://www.malware-traffic-analysis.net/index.html) - [waybackmachine](http://web.archive.org/) - [Поиск по онлайн-paste-инструментам](https://redhuntlabs.com/online-ide-search/) - [dnshistory](https://dnshistory.org/) - [asnlookup](https://asnlookup.com/) - [Проверка расширений браузера - CRXaminer](https://crxaminer.tech/) - [ipinfo.io](https://ipinfo.io) - [fofa.info](https://fofa.info/) - [SecurityTrail](https://securitytrails.com/) - [ZommEye](https://www.zoomeye.ai/) - [Проверка BlueCoat](https://sitereview.bluecoat.com/) - [Проверка Norton](https://safeweb.norton.com/) - [Проверка Fortinet](https://www.fortiguard.com/webfilter) - [Проверка McAfee](https://sitelookup.mcafee.com/) - [Проверка Trellix](https://trustedsource.org/) - [Проверка Palo Alto](https://urlfiltering.paloaltonetworks.com/query/) - [Проверка Talos Intelligence](https://www.talosintelligence.com/reputation_center) - [Проверка Checkpoint](https://urlcat.checkpoint.com/urlcat/main.htm) - [Проверка Cyren](https://www.cyren.com/security-center/url-category-check-gate) - [Проверка Forcepoint](https://support.forcepoint.com/s/site-lookup) - [Проверка TrendMicro](https://global.sitesafety.trendmicro.com/) - [База данных USB и PCI - DeviceHunt](https://devicehunt.com/)

#### 🔬 Песочница / Эмуляция

- [Песочница Anyrun](https://any.run/) - [triage](https://tria.ge/s) - [capesandbox](https://www.capesandbox.com/) - [joesandbox](https://www.joesandbox.com/analysispaged/0) - [filescan.io](https://www.filescan.io/) - [Hybrid Analysis](https://www.hybrid-analysis.com/) - [virustotal](https://www.virustotal.com) - [threat zone](https://app.threat.zone/scan) - [vmray](https://www.vmray.com/) - [kaspersky opentip](https://opentip.kaspersky.com/requests) - [speakeasy (эмуляция режима ядра и пользовательского режима)](https://github.com/mandiant/speakeasy) - [DOGGuard](https://app.docguard.io/) - [Kaspersky Threat Intelligence Portal](https://opentip.kaspersky.com/?tab=upload)

### 🧩 Обработка данных

- [CyberChef](https://gchq.github.io/CyberChef/) - [jsoncrack](https://jsoncrack.com/editor) - [отладчик Grok](https://grokdebugger.com/) - [JS деобфускатор](https://lelinhtinh.github.io/de4js/) - [онлайн-анализатор PCAP](https://apackets.com/) - [калькулятор хэшей](https://md5calc.com/hash) - [regex101](https://regex101.com/) - [онлайн-анализатор PCAP](https://apackets.com/) - [Javascript деобфускатор - deobfuscate.relative.im](https://deobfuscate.relative.im/) - [Javascript деобфускатор - de4js](https://lelinhtinh.github.io/de4js/) - [JSONViewer](https://jsonviewer.stack.hu/) - [TextMechanic](https://textmechanic.com/) - [UrlEncode.org](https://www.urlencoder.org/) - [TextFixer](https://www.textfixer.com/) - [RegExr](https://regexr.com/) - [TextUtils](https://textutils.com/) - [TextCompactor](https://textcompactor.com/) - [Pretty Diff](https://prettydiff.com/) - [XML Tree](http://www.xmltree.com/) - [Онлайн-форматировщик и Beautifier XML](https://www.freeformatter.com/xml-formatter.html) - [Инструмент экранирования XML](https://www.freeformatter.com/xml-escape.html) - [DiffChecker](https://www.diffchecker.com/) - [CSVJSON](https://www.csvjson.com/) - [Форматировщик HTML](https://htmlformatter.com/) - [Текстовый инструмент](https://texttools.netlify.app/) - [Инструмент для работы со строками](https://string-functions.com/) - [unshorten it](https://www.unshorten.it) - [urlunscrambler](https://www.urlunscrambler.com/) - [URLEncode & Decode](https://www.urlencoder.org/) - [longurl](https://www.longurl.org/) - [Заголовок сообщения](https://mha.azurewebsites.net/pages/mha.html) - [MXToolbox EmailHeaders](https://mxtoolbox.com/EmailHeaders.aspx) - [Анализатор заголовков писем](https://emailheaders.verification-check.com/) - [Анализ заголовков писем](https://www.email-format.com/header-analysis/) - [Дашборд Gitlab из Excel](https://thisdavej.com/copy-table-in-excel-and-paste-as-a-markdown-table/) - [uncoder](https://uncoder.io/) - [DeHashed](https://dehashed.com/) - [Diff Checker](https://www.diffchecker.com/) - [IT-инструменты](https://it-tools.tech/) - [ChatGPT](https://chatgpt.com/)

### 📡 Ресурсы по детектированию

- [Списки детектирования](https://github.com/mthcht/awesome-lists/tree/main/Lists) - [Техники MITRE](https://attack.mitre.org/techniques/enterprise/) - [Обновления MITRE](https://attack.mitre.org/resources/updates/) - [MITRE D3fend](https://d3fend.mitre.org/) - [Навигатор MITRE](https://mitre-attack.github.io/attack-navigator/) - [Источники данных MITRE](https://attack.mitre.org/datasources/) - [GTFOBIN](https://github.com/mthcht/GTFOBins.github.io) - [LOLBAS](https://github.com/mthcht/LOLBAS) - [LOTS](https://lots-project.com/) - [LOLRMM](https://github.com/magicsword-io/LOLRMM) - [loldrivers](https://www.loldrivers.io/) - [LOLRMM](https://github.com/magicsword-io/LOLRMM) - [LOLC2](https://github.com/lolc2/lolc2.github.io) - [LOLESXI](https://github.com/LOLESXi-Project/LOLESXi) - [WTFBIN](https://wtfbins.wtf/) - [Sigma](https://github.com/mthcht/sigma/tree/master/rules) - [Правила Splunk](https://research.splunk.com/detections/) - [Правила Elastic](https://github.com/elastic/detection-rules) - [Sigma-правила DFIR-Report](https://github.com/The-DFIR-Report/Sigma-Rules) - [Sigma-правила JoeSecurity](https://github.com/joesecurity/sigma-rules/tree/master/rules) - [Sigma-правила mdecrevoisier](https://github.com/mdecrevoisier/SIGMA-detection-rules) - [Sigma-правила P4T12ICK](https://github.com/P4T12ICK/Sigma-Rule-Repository) - [Sigma-правила tsale](https://github.com/tsale/Sigma_rules) - [список ресурсов по детектированию](https://github.com/jatrost/awesome-detection-rules) - [KQL поисковые запросы](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules) - [ресурсы по detection engineering](https://github.com/infosecB/awesome-detection-engineering) - [Ресурс Defender](https://defenderresourcehub.info/) - [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection) - [LOLOLFarm](https://lolol.farm/)

### 🌐 Новости безопасности

- [Adam Chester Blog Feed](https://blog.xpnsec.com/rss.xml) - [ahnlab apt feed](https://asec.ahnlab.com/en/category/apt-en/feed/) - [ahnlab cert feed](https://asec.ahnlab.com/en/category/cert-en/feed) - [ahnlab phishing feed](https://asec.ahnlab.com/en/category/phishing-scam-en/feed) - [ahnlab trend feed](https://asec.ahnlab.com/en/category/trend-en/feed) - [Akamai blog feed](https://feeds.feedburner.com/akamai/blog) - [Any.run malware analysis blog feed](https://any.run/cybersecurity-blog/category/malware-analysis/feed/) - [Avast Blog feed](https://blog.avast.com/rss.xml) - [badsectorlabs Last week in security - Redteam](https://blog.badsectorlabs.com/feeds/all.atom.xml) - [bi-zone blog feed](https://medium.com/feed/@bi-zone) - [bitdefender labs feed](https://www.bitdefender.com/nuxt/api/en-us/rss/labs/) - [binarydefense blog feed](https://www.binarydefense.com/feed/) - [Blackberry blog](https://blogs.blackberry.com/en/home) - [Bleepingcomputer Feed](https://www.bleepingcomputer.com/feed/) - [bleepingcomputer feed](https://www.bleepingcomputer.com/feed/) - [broadcom blog feed](https://sed-cms.broadcom.com/rss/v1/blogs/rss.xml) - [CERT FR Alerts](https://www.cert.ssi.gouv.fr/alerte/) - [CERT FR Avis](https://www.cert.ssi.gouv.fr/avis/) - [CERT LV feed](https://cert.lv/en/feed/rss/all) - [CERT PL feed](https://cert.pl/en/rss.xml) - [CERT SE feed](https://www.cert.se/feed.rss) - [CERT SI feed](https://www.cert.si/en/category/news/feed/) - [CERT UA feed](https://cert.gov.ua/api/articles/rss) - [CERT-FR](https://www.cert.ssi.gouv.fr/) - [Checkpoint Research feed](https://research.checkpoint.com/feed) - [CIRT bd feed](https://www.cirt.gov.bd/feed/) - [CISA news feed](https://www.cisa.gov/cybersecurity-advisories/all.xml) - [CISA news](https://www.cisa.gov/news-events/news) - [Cisco Talos](https://www.talosintelligence.com/) - [claroty team82 research](https://claroty.com/team82/research/) - [Cloudfare security feed](https://blog.cloudflare.com/tag/security/rss) - [Clément Notin Feed](https://clement.notin.org/feed.xml) - [crowdstrike counter adversary operations blog](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) - [deepinstinct blog](https://www.deepinstinct.com/blog) - [detect.fyi](https://detect.fyi/) - [Detection engineering weekly](https://www.detectionengineering.net/) - [DFIR weekly news](https://thisweekin4n6.com/) - [DFIR weekly news feed](https://thisweekin4n6.wordpress.com/feed/) - [drweb virus alert feed](https://news.drweb.com/rss/get/?c=9) - [eclecticiq threat intel](https://www-eclecticiq-com.sandbox.hs-sites.com/blog?type=intelligence-research#overview) - [Elastic security labs blog](https://www.elastic.co/security-labs) - [elastic security labs blog feed](https://www.elastic.co/security-labs/rss/feed.xml) - [EricaZelic Blog](https://ericazelic.medium.com/) - [forcepoint lab blog](https://www.forcepoint.com/blog/x-labs) - [genians threat intel feed](https://www.genians.co.kr/blog/threat_intelligence/rss.xml) - [gi7w0rm threat intel feed](https://medium.com/feed/@gi7w0rm) - [Google Project Zero blog feed](https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss) - [Google threat intelligence feed](https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v) - [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence) - [Google Threat analysis feed](https://blog.google/threat-analysis-group/rss/) - [Group-IB feed](https://blog.group-ib.com/rss.xml) - [HackerNews Feed](https://feeds.feedburner.com/TheHackersNews) - [harfanglab lab feed](https://harfanglab.io/insidethelab/feed/) - [hexacorn blog feed](http://www.hexacorn.com/blog/feed/) - [horizon3 Feed](https://www.horizon3.ai/feed/) - [hunt.io blog](https://hunt.io/blog) - [huntress blog feed](https://www.huntress.com/blog/rss.xml) - [IC3 CSA feed](https://www.ic3.gov/CSA/rss) - [Infostealers Hub News Feed](https://www.infostealers.com/learn-info-stealers/feed/) - [infostealers reports feed](https://www.infostealers.com/info-stealers-reports/feed/) - [Intrinsec feed](https://www.intrinsec.com/feed/) - [isc sans edu feed](https://isc.sans.edu/rssfeed.xml) - [JPCERT feed](https://blogs.jpcert.or.jp/en/atom.xml) - [JPCERT](https://www.jpcert.or.jp/english/) - [krebsonsecurity feed](https://krebsonsecurity.com/feed/) - [malwarebytes blog feed](https://www.malwarebytes.com/blog/feed/index.xml) - [malwaretech feed](https://www.malwaretech.com/feed) - [Mauricio Velazco Blog](https://medium.com/@mvelazco) - [mcafee labs feed](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/feed/) - [Michael Haag Blog](https://haggis-m.medium.com/) - [Microsoft security blog feed](https://www.microsoft.com/en-us/security/blog/feed/) - [Microsoft Incident response ninja hub](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/welcome-to-the-microsoft-incident-response-ninja-hub/4243594) - [Microsoft Threat Intel feed](https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed) - [morphisec threat research](https://blog.morphisec.com/topic/threat-research) - [NCC Group research feed](https://research.nccgroup.com/feed/) - [nccgroup research blog security](https://www.nccgroup.com/us/research-blog/?resource=18345&category=18146#hub) - [NCSC news feed](https://feeds.english.ncsc.nl/news.rss) - [NIST CVEs](https://nvd.nist.gov/vuln/search/results?isCpeNameSearch=false&results_type=overview&form_type=Basic&search_type=all&startIndex=0) - [NIST cybersecurity insights feed](https://www.nist.gov/blogs/cybersecurity-insights/rss.xml) - [Offensive Research - DSAS by INJECT](https://blog.injectexp.dev/) - [orangecyberdefense Intel](https://www.orangecyberdefense.com/global/blog?tx_solr%5Bfilter%5D%5B0%5D=tags%3AIntelligence-led+Security) - [outpost24 research and threat intel feed](https://outpost24.com/blog/category/research-and-threat-intel/feed/) - [proofpoint threat insight](https://www.proofpoint.com/us/blog/threat-insight#) - [Qualys Threat research feed](https://blog.qualys.com/vulnerabilities-threat-research/feed) - [redcanary feed](https://www.redcanary.co/feed/) - [reversinglabs threat research](https://www.reversinglabs.com/blog/tag/threat-research) - [sans blog](https://www.sans.org/blog/) - [security.com threat intel](https://www.security.com/threat-intelligence) - [securityaffairs apt feed](https://securityaffairs.com/category/apt/feed) - [securityweek feed](https://www.securityweek.com/feed/) - [securlist apt targeted attacks feed](https://securelist.com/threat-category/apt-targeted-attacks/feed/) - [Sekoia Blog](https://blog.sekoia.io/) - [Sekoia blog feed](https://blog.sekoia.io/feed/) - [SentinelOne labs feed](https://www.sentinelone.com/labs/feed/) - [seqrite techical blog](https://www.seqrite.com/blog/category/technical/) - [Simone Kraus blog feed](https://medium.com/feed/@simone.kraus) - [sophos threat research feed](https://news.sophos.com/en-us/category/threat-research/feed/) - [specterops feed](https://posts.specterops.io/feed) - [Splunk Research Blog](https://www.splunk.com/en_us/blog/author/secmrkt-research.html) - [Sybersecyrity news feed](https://cybersecuritynews.com/feed/) - [Talos feed](https://feeds.feedburner.com/feedburner/Talos) - [tenable Blog](https://medium.com/tenable-techblog) - [The HackerNews feed](https://feeds.feedburner.com/TheHackersNews) - [thedfirreport feed](https://thedfirreport.com/feed/) - [threat connect blog feed](https://threatconnect.com/blog/feed/) - [threatlabz zscaler blog](https://threatlabz.zscaler.com/blogs) - [threatpost feed](https://threatpost.com/feed/) - [trendmicro security feed](http://feeds.trendmicro.com/TrendMicroSimplySecurity) - [Trustwave blog feed](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rss.xml) - [Twitter](https://twitter.com/home) - [Unit42 feed](http://feeds.feedburner.com/Unit42) - [Unit42 feed](https://unit42.paloaltonetworks.com/feed/) - [virusbulletin feed](https://www.virusbulletin.com/rss) - [virusbulletin](https://www.virusbulletin.com/virusbulletin/) - [volexity blog feed](https://www.volexity.com/blog/feed/) - [welivesecurity feed](https://www.welivesecurity.com/en/rss/feed/) - [tl;dr sec newsletter](https://tldrsec.com/)

### 📺 YouTube/Twitch-каналы

- [DFIR - 13cubed videos](https://www.youtube.com/@13Cubed/videos) - [DFIR - SANS videos](https://www.youtube.com/@SANSForensics/videos) - [DFIR - MyDFIR](https://youtube.com/@mydfir) - [DFIR - DFIRScience](https://www.youtube.com/@DFIRScience/videos) - [Malware Analysis - jstrosch](https://www.youtube.com/@jstrosch/videos) - [Malware Analysis - cyberraiju](https://www.youtube.com/@cyberraiju/videos) - [Malware Analysis - Botconf](https://www.youtube.com/@BotConfTV) - [DFIR - AntisyphonTraining](https://www.youtube.com/@AntisyphonTraining) - [DFIR - BlackPerl](https://youtube.com/watch?v=KzD0MmEYAzQ&list=PLjWEV7pmvSa6f-NTpXsaUYWZLjLAB_0TS) - [Malware Analysis - malwareanalysisforhedgehogs](https://youtube.com/@malwareanalysisforhedgehogs?si=rHy80uPhjtyPtX0K) - [DFIR - BlueMonkey4n6](https://www.youtube.com/@BlueMonkey4n6/playlists) - [DFIR - binaryzone](https://www.youtube.com/@binaryz0ne/playlists) - [Detection Engineering - Splunk - atomicsonafriday](https://www.youtube.com/@atomicsonafriday/streams) - [Exploitation - HackerSploit](https://www.youtube.com/@HackerSploit/playlists) - [DFIR - TheTaggartInstitute](https://www.youtube.com/@TheTaggartInstitute/videos) - [Malware Analysis - JohnHammond](https://www.youtube.com/@_JohnHammond) - [Malware Analysis - invokereversing](https://youtube.com/@invokereversing) - [Exploitation - Defcon Talks](https://www.youtube.com/user/DEFCONConference/videos) + https://media.defcon.org/ - [Exploitation - Alh4zr3d - twitch](https://www.twitch.tv/Alh4zr3d) - [Exploitation - Alh4zr3d - youtube](https://www.youtube.com/@alh4zr3d3/videos) - [Exploitation - incodenito](https://youtube.com/@incodenito?si=uV9UDhYFs_vQYayR) - [Exploitation - dayzerosec](https://www.youtube.com/@dayzerosec/videos) - [Malware Analysis - MalwareTechBlog](https://www.youtube.com/@MalwareTechBlog) - [Malware Analysis - radkawar](https://www.youtube.com/@radkawar) - [Exploitation - LiveOverflow](https://www.youtube.com/@LiveOverflow) - [Malware Analysis - neoeno](https://youtube.com/@neoeno4242?si=_mVioHsmbvu17KNk) - [Malware Analysis - AzakaSekai](https://www.youtube.com/@AzakaSekai) - [CTI - bushidotoken](https://youtube.com/@bushidotoken) - [CTI - @TLP_R3D](https://www.youtube.com/@TLP_R3D) - [Windows Internal - @mrexodia](https://www.youtube.com/@mrexodia) - [!!! Exploitation - ippsec](https://www.youtube.com/@ippsec) - [Exploitation - flangvik](https://youtube.com/@flangvik?si=vVShvHdg3QCLrHJf) - [Conferences channel - scrtinsomnihack](https://www.youtube.com/@scrtinsomnihack/videos) - [Conferences channel - OffensiveCon](https://www.youtube.com/@OffensiveCon/videos) - [Conferences channel - BSidesSF](https://www.youtube.com/@BSidesSF/videos) - [Conferences channel - BSidesTLV](https://www.youtube.com/@BSidesTLV/videos) - [Conferences channel - bsidesbudapest](https://www.youtube.com/@bsidesbudapest/videos) - [Conferences channel - SecuritybsidesOrgUk](https://www.youtube.com/@SecuritybsidesOrgUk/videos) - [Conferences channel - bsidescanberra9688](https://www.youtube.com/@bsidescanberra9688/videos) - [Conferences channel - brucontalks](https://www.youtube.com/@brucontalks/videos) - [Conferences channel - DEFCONConference](https://www.youtube.com/@DEFCONConference/videos) - [Conferences channel - Disobey](https://www.youtube.com/@Disobey/videos) - [Conferences channel - hitbsecconf](https://www.youtube.com/@hitbsecconf/videos) - [Conferences channel - SANSOffensiveOperations](https://www.youtube.com/@SANSOffensiveOperations/videos) - [Conferences channel - BlackHillsInformationSecurity](https://www.youtube.com/@BlackHillsInformationSecurity/videos) - [Conferences channel - RITSEC](https://www.youtube.com/@RITSEC/videos) - [Conferences channel - Preludeorg](https://www.youtube.com/@Preludeorg/videos) - [Conferences channel - BlackHatOfficialYT](https://www.youtube.com/@BlackHatOfficialYT/videos) - [Conferences channel - TROOPERScon](https://www.youtube.com/@TROOPERScon/videos) - [Conferences site - infocon.org](https://infocon.org/cons/) - [Conferences site - sectube.tv](https://sectube.tv/) - [Conferences channel - x33conf](https://www.youtube.com/@x33fcon/videos)

### 🎙️ Подкасты

- [darknetdiaries](https://darknetdiaries.com/) - [risky.biz](https://risky.biz/) - [DFIR Podcasts](https://digitalforensicsurvivalpodcast.libsyn.com/podcast) - [cloud.withgoogle.com](https://cloud.withgoogle.com/cloudsecurity/podcast/) - [Internet Storm Center sans podcast](https://isc.sans.edu/podcast.html) - [7 minutes security Podcast](https://7minsec.com/) - [hacking-humans](https://thecyberwire.com/podcasts/hacking-humans/) - [dayzerosec](https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt) - [CISO series](https://cisoseries.com/category/podcast/cyber-security-headlines/) - [Splunk Atomic on Friday](https://www.youtube.com/@atomicsonafriday/streams) - [NolimitSecu (FR)](https://www.nolimitsecu.fr/) - [HacknSpeak (FR)](https://open.spotify.com/show/2lwA1WLVqnYvnlc7WkV3yU) - [Radio CSIRT (FR)](https://www.radiocsirt.org) - [DEV podcasts (FR)](https://www.ifttd.io/liste-des-episodes) - [Security Conversations](https://securityconversations.com/) - [Monde de la cyber (FR)](https://open.spotify.com/show/0uNuF41uZYwwik1AW6hOSM?si=iv8LKD8VQQSM8Tqf-F1X0w)

### 💬 Discord /Slack-каналы

- [RedTeam - 🔥 Initial Access Guild 🔥 Discord](https://discord.com/channels/1118340483337424936) - [RedTeam - 🔥 Red-Team VX community 🔥 Discord](https://discord.com/channels/1012733841229746240) - [RedTeam - BloodHoundHQ Slack](https://github.com/mthcht/awesome-lists/blob/main/bloodhoundhq.slack.com) - [RedTeam - evilsocket Discord](https://discord.com/channels/1100085665766572142) - [RedTeam - OffSec Discord](https://discord.com/channels/780824470113615893/) - [Threat Hunting - Threat Hunter community Discord](https://discord.com/channels/690293821866508430/) - [PurpleTeam - Ipurpleteam Discord](https://discord.com/channels/1285691872928595968) - [Blueteam Detection engineering - Hunter's Den Discord](https://discord.com/channels/1104707391569797200) - [Blueteam Detection engineering - Sigma HQ Discord](https://discord.com/channels/1176230866515669072) - [Blueteam Threat Intel - Malcore Discord](https://discord.com/channels/1087758991809060876/1165463214457368677)

### 📚 Обучение

#### DFIR - 13cubed - Investigating Windows Endpoints [13cubed.com -windows endpoints](https://training.13cubed.com/investigating-windows-endpoints) - 13cubed - Investigating Windows Memory [13cubed.com -windows memory](https://training.13cubed.com/investigating-windows-memory) - 13cubed - Investigating Linux Devices [13cubed.com - linux](https://training.13cubed.com/investigating-linux-devices) - SANS: [FOR500](https://www.sans.org/cyber-security-courses/windows-forensic-analysis/) - SANS: [FOR508](https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/) - Defensive-security: [Linux-live-forensics](https://edu.defensive-security.com/linux-attack-live-forensics-at-scale) - @0gtweet - Forensic course: [Mastering Windows Forensics](https://grzegorz-tworek-s-school.teachable.com/) - @DebugPrivilege : Forensic Debugging free course [InsightEngineering](https://github.com/DebugPrivilege/InsightEngineering) - Challenges: - Arsenal Recon Disks Images for DFIR: [publicly-accessible-disk-images](https://arsenalrecon-dev.s3.amazonaws.com/blog/publicly-accessible-disk-images-&-mobile-extractions-grid-for-dfir---september-24-2024-update.pdf) - @inversecos - APT Emulation Labs: [xintra](https://www.xintra.org/labs) - @TheDFIRReport : LABs with logs from the existing reports [dfir-labs](https://the-dfir-report-store.myshopify.com/collections/dfir-labs) - @ACEresponder: Courses with Detailed Explanations and Labs [aceresponder.com](https://www.aceresponder.com/challenges) - @binaryz0ne: DFIR challenges with [Datasets](https://www.ashemery.com/dfir.html) + [Linux forensic workshop](https://github.com/ashemery/LinuxForensics) #### SOC - tryhackme - [SOC lvl 1](https://tryhackme.com/path/outline/soclevel1) - tryHackme - [SOC lvl 2](https://tryhackme.com/path/outline/soclevel2) - letsdefend.io @chrissanders88 - [letsdefend.io](https://app.letsdefend.io/training) - Constructing Defense [constructingdefense.com](https://course.constructingdefense.com/constructing-defense) - SANS: [SANS555](https://www.sans.org/cyber-security-courses/siem-with-tactical-analytics/) - Xintra: [Attacking and Defending Azure M365](https://training.xintra.org/attacking-and-defending-azure-m365) - Challenges: - Splunk Boss Of The SOC - [BOTS](https://bots.splunk.com/) - BOTS [dataset v1](https://github.com/splunk/botsv1) - BOTS [dataset v2](https://github.com/splunk/botsv2) - BOTS [dataset v3](https://github.com/splunk/botsv3) - @TheDFIRReport : LABs with logs from the existing reports [dfir-labs](https://the-dfir-report-store.myshopify.com/collections/dfir-labs) - @ACEresponder: Courses with Detailed Explanations and Labs [aceresponder.com](https://www.aceresponder.com/challenges) - @inversecos - APT Emulation Labs: [xintra](https://www.xintra.org/labs) #### Offensive - [OSCP - HTB](https://0xdf.gitlab.io/cheatsheets/offsec) - [OSCP - Course PEN200](https://www.offsec.com/courses/pen-200/) - [OSEP - Course PEN300](https://www.offsec.com/courses/pen-300/) #### Challenges - [HackTheBox](https://www.hackthebox.com) - [Pentestlab](https://pentesterlab.com) - [Root-Me](https://www.root-me.org) - [TryHackMe](https://tryhackme.com) - [Zenk-Security](https://www.zenk-security.com/challenges) #### RE / Malware Analysis / Deep Dive - [OpenSecurityTraining2](https://p.ost2.fyi/)

### 📚 Книги

#### DFIR - [Practical Forensic Imaging](https://www.amazon.com/Practical-Forensic-Imaging-Securing-Evidence/dp/1593277938) - [Practical-Linux-Forensics-Digital-Investigators](https://www.amazon.com/Practical-Linux-Forensics-Digital-Investigators-ebook/dp/B096Z4CRC8) - [TheHitchhikersGuidetoDFIRExperiencesFromBeginnersandExperts - Free](https://leanpub.com/TheHitchhikersGuidetoDFIRExperiencesFromBeginnersandExperts) - [Forensic Artifacts - Microsoft GuideBook - free](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/IR-Guidebook-Final.pdf) - [Eric Zimmerman Manual Tools - Free](https://leanpub.com/eztoolsmanuals) - [The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory](https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware/dp/1118825098) - [Applied Incident Response](https://www.amazon.com/Applied-Incident-Response-Steve-Anson/dp/1119560268) - [SANS FOR500 / FOR508 book](https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/) - [Blue Team Handbook: Incident Response Edition](https://www.amazon.com/dp/B0G4KS5JXK) - [Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software](https://www.amazon.com/Practical-Malware-Analysis-Hands-Dissecting/dp/1593272901) - [Placing the Suspect Behind the Keyboard: DFIR Investigative Mindset](https://www.amazon.com/Placing-Suspect-Behind-Keyboard-Investigative/dp/B0CZPJF23Q) - [Crafting the InfoSec Playbook: Security Monitoring and Incident](https://www.amazon.com/Crafting-InfoSec-Playbook-Security-Monitoring/dp/1491949406) - [Investigating Windows Systems](https://www.amazon.com/Investigating-Windows-Systems-Harlan-Carvey/dp/0128114150)#### Анализ вредоносных программ - [Practical Malware Analysis: практическое руководство по разбору вредоносных программ](https://www.amazon.com/Practical-Malware-Analysis-Hands-Dissecting/dp/1593272901) - [Искусство анализа памяти: обнаружение вредоносных программ и угроз в памяти Windows, Linux и Mac](https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware/dp/1118825098) - [Evasive Malware: практическое руководство по обнаружению, анализу и нейтрализации сложных угроз](https://www.amazon.fr/Evasive-Malware-Understanding-Deceptive-Self-Defending/dp/1718503261) #### SOC - [Blue Team Handbook: SOC, SIEM и охота за угрозами](https://www.amazon.com/Blue-Team-Handbook-Condensed-Operations/dp/1091493898) - [BTFM: Полевой справочник синей команды](https://www.amazon.fr/Blue-Team-Field-Manual-BTFM/dp/154101636X) - [PTFM: Полевой справочник фиолетовой команды](https://www.amazon.com/PTFM-Purple-Team-Field-Manual/dp/B08LJV1QCD) + [PTFM: Полевой справочник фиолетовой команды v2](https://www.amazon.com/PTFM-2nd-Purple-Field-Manual/dp/1736526790) - [EDR — введение в безопасность конечных точек](https://www.amazon.com/Endpoint-Detection-Response-Essentials-deployment/dp/1835463266) - [MITRE — 11 стратегий центра операций кибербезопасности мирового класса](https://www.amazon.com/Strategies-World-Class-Cybersecurity-Operations-Center-ebook/dp/B09ZDWRFMW) - [Общая картина работы SOC — Modern SOC](https://www.amazon.com/Modern-Security-Operations-Center-ebook/dp/B08BW8Y9Q4) - [Practical Malware Analysis: практическое руководство по разбору вредоносных программ](https://www.amazon.com/Practical-Malware-Analysis-Hands-Dissecting/dp/1593272901) - [Книга SANS 555](https://www.sans.org/cyber-security-courses/siem-with-tactical-analytics/) #### Глубокое погружение - [Книги Windows Internals](https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals) - [Как работает Linux](https://www.amazon.com/How-Linux-Works-Brian-Ward-ebook/dp/B07X7S1JMB) - [Драйверы устройств Linux](https://lwn.net/Kernel/LDD3/) - [Понимание менеджера виртуальной памяти Linux](https://www.kernel.org/doc/gorman/pdf/understand.pdf) - [Linux insides](https://github.com/0xAX/linux-insides/blob/master/SUMMARY.md) - [Linux Ebpf](https://www.amazon.com/Learning-eBPF-Programming-Observability-Networking/dp/1098135121) - [Внутреннее устройство безопасности Windows](https://www.oreilly.com/library/view/windows-security-internals/9781098168834) #### Эксплуатация - [Искусство взлома и эксплуатации](https://www.amazon.com/Hacking-Art-Exploitation-Jon-Erickson-ebook/dp/B004OEJN3I) - [Hacker Playbook: практическое тестирование на проникновение](https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2) - [RTFM: Полевой справочник красной команды](https://www.amazon.com/RTFM-Red-Team-Field-Manual-ebook/dp/B0B7H8X3XY) - [Red Team Development and Operations: практическое руководство](https://www.amazon.com/Red-Team-Development-Operations-practical-ebook/dp/B0842BMMCC) - [RTRM: Справочное руководство красной команды](https://www.amazon.com/RTRM-Red-Team-Reference-Manual/dp/B08N37KDPQ) - [POC||GTFO](https://nostarch.com/search/gtfo) #### AI - [Практическое машинное обучение](https://www.amazon.fr/Hands-Machine-Learning-Scikit-learn-Tensorflow/dp/1492032646)

### 📚 База знаний

- [DFIR — глубокое погружение в NTFS — ntfs.com](https://www.ntfs.com/index.html) - [DFIR — aboutdfir](https://aboutdfir.com/) - [DFIR — криминалистические артефакты — руководство Microsoft](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/IR-Guidebook-Final.pdf) - [Анализ вредоносных программ — unprotect.it — техники обхода защиты](https://unprotect.it/) - [Эксплуатация — hacktricks](https://book.hacktricks.xyz/) - [Эксплуатация — PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) - [Эксплуатация — red-team-note](https://dmcxblue.gitbook.io/red-team-notes-2-0/files/red-team-guide) - [Эксплуатация — Red Team Notes](https://www.ired.team/) - [DFIR — анализ инструментов JPCERT](https://jpcertcc.github.io/ToolAnalysisResultSheet/) - [Эксплуатация — Red Team TTP](https://rosesecurity.gitbook.io/red-teaming-ttps) - [Linux — документация eBPF](https://docs.ebpf.io/) - [DFIR — Microsoft NinjaHub](https://aka.ms/MicrosoftIRNinjaHub) - [Разработка — сигнатуры Windows PInvoke](https://pinvoke.net/) - [Конфиденциальность — руководство по конфиденциальности VPN](https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-NCAaURrXwsR1MsLpVmAt3bwg) - [Обнаружение — атака и защита GCP](https://github.com/anrbn/GCP-Attack-Defense) - [Обнаружение — атака и защита Azure](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense) - [Обнаружение — проект Unprotect](https://unprotect.it/snippets/) - [Эксплуатация — рецепты хакера](https://www.thehacker.recipes/) - [Логи — идентификаторы событий и другое — eventlog-compendium](https://eventlog-compendium.streamlit.app/) - [Логи — идентификаторы событий — ultimatewindowssecurity](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx) - [Логи — идентификаторы событий и политики — Microsoft](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings) - [Логи — типы входа по идентификаторам событий — Microsoft](https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types) - [Логи — схема Azure SigninLogs](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs) - [Логи — обнаружение рисков Azure SigninLogs](https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0) - [Логи — коды ошибок AADSTS](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes) - [Логи — поиск ошибок Microsoft](https://login.microsoftonline.com/error) - [Логи — коды ошибок аутентификации и авторизации Microsoft Entra](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes) - [Логи — идентификаторы событий Microsoft Defender](https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus) - [Логи — справочник оповещений Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference) - [Логи — справочник оповещений Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/alerts-overview) - [Логи — схемы Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables) - [Логи — идентификаторы событий отладки Microsoft DNS](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn800669(v=ws.11)#dns-logging-and-diagnostics-1) - [Логи — идентификаторы событий Sysmon](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#events) - [больше шпаргалок](https://github.com/r1cksec/cheatsheets) - [Эксплуатация — подробности TLS](https://tls12.xargs.org/) - [SOC — заголовки писем IANA](https://www.iana.org/assignments/message-headers/message-headers.xhtml) - [SOC — DKIM, DMARC, SPF](https://github.com/nicanorflavier/spf-dkim-dmarc-simplified) - [SOC — протокол Kerberos простыми словами](https://en.hackndo.com/kerberos/) - [SOC — атаки на AD от ADSecurity](https://adsecurity.org/?page_id=4031) - [SOC — Pass the Ticket простыми словами](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1550-use-alternate-authentication-material/pass-the-ticket) - [SOC — Kerberoasting простыми словами](https://en.hackndo.com/kerberoasting/) - [SOC — неограниченное делегирование Kerberos простыми словами](https://en.hackndo.com/constrained-unconstrained-delegation/) - [SOC — AS-REP roasting простыми словами](https://en.hackndo.com/kerberos-asrep-roasting/) - [SOC — золотые билеты (Golden tickets) простыми словами](https://en.hackndo.com/kerberos-silver-golden-tickets/) - [SOC — серебряный билет (Silver Ticket) простыми словами](https://en.hackndo.com/kerberos-silver-golden-tickets/) - [SOC — Skeleton Key простыми словами](https://adsecurity.org/?p=1255) - [SOC — NTLM Relay простыми словами](https://en.hackndo.com/ntlm-relay/) - [SOC — отравление LLMNR простыми словами](https://medium.com/@rymak/llmnr-poisoning-an-attack-on-the-active-directory-of-an-organization-9907bf0498ff) - [SOC — DCsync простыми словами](https://adsecurity.org/?p=1729) - [SOC — атака DCshadow простыми словами](https://www.dcshadow.com/) - [SOC — вопросы для собеседования от LetsDefend](https://github.com/LetsDefend/SOC-Interview-Questions) - [SOC — объяснение аргументов shell-команд](https://explainshell.com/)

### 🧪 Лаборатория

- [Автоматизация лаборатории — ludus](https://gitlab.com/badsectorlabs/ludus) - [Лабораторная среда — Windows — GOAD](https://github.com/Orange-Cyberdefense/GOAD) - [Автоматизация лаборатории — warhorse](https://github.com/warhorse/warhorse) - [Автоматизация лаборатории — Azure — BadZure](https://github.com/mvelazc0/BadZure) - [Автоматизация лаборатории — Azure — AzureGoat](https://github.com/ine-labs/AzureGoat) - [ОС — анализ вредоносных программ — flare-vm](https://github.com/mandiant/flare-vm) - [Песочница — cuckoo](https://github.com/cuckoosandbox/cuckoo) - [Песочница — CAPEv2](https://github.com/kevoreilly/CAPEv2) - [Песочница — Malice (самостоятельно размещаемый клон VirusTotal)](https://github.com/maliceio/malice) - [Платформа обнаружения — wazuh](https://github.com/wazuh/wazuh) - [Платформа обнаружения — securityonion](https://github.com/Security-Onion-Solutions/securityonion) - [Платформа обнаружения — Splunk](https://www.splunk.com/en_us/download.html) - [Платформа обнаружения — Elastic](https://www.elastic.co/downloads/elasticsearch) - [Развёртывание — ansible](https://github.com/ansible/ansible) - [SOC — автоматизация фабрики сценариев использования — DetectIQ](https://github.com/AttackIQ/DetectIQ) - [Сетевые логи — StratosphereLinuxIPS](https://github.com/stratosphereips/StratosphereLinuxIPS) - [Сетевые логи — flare-fakenet-ng](https://github.com/mandiant/flare-fakenet-ng) - [Сетевые логи — maltrail](https://github.com/stamparm/maltrail) - [Purpleteam — openbas](https://github.com/OpenBAS-Platform/openbas) - [Honeypot — LLM-ловушка galah](https://github.com/0x4D31/galah) - [Honeypot — canary](https://github.com/thinkst/opencanary) - [Honeypot — opencanary](https://github.com/thinkst/opencanary) - [Honeypot — Respotter (ловушка для Responder)](https://github.com/lawndoc/Respotter) - [Honeypot — Certiception (ловушка для ADCS)](https://github.com/srlabs/Certiception) - [Honeypot — cowrie](https://github.com/cowrie/cowrie) - [Maldev — обход защиты — avred](https://github.com/dobin/avred) - [Maldev — обход защиты — gocheck](https://github.com/gatariee/gocheck) - [Разведка — HEDnsExtractor](https://github.com/HuntDownProject/HEDnsExtractor) - [Агент обнаружения — агент Sandfly для Linux](https://github.com/sandflysecurity/sandfly-setup) - [Пересылка логов — openwec (пересыльщик событий Windows)](https://github.com/cea-sec/openwec) - [Платформа охоты за угрозами — deephunter](https://github.com/sebastiendamaye/deephunter) - [Логи Windows — JonMon](https://github.com/jsecurity101/JonMon) - [Логи Windows — Sysmon](https://learn.microsoft.com/pt-br/sysinternals/downloads/sysmon) - [Логи Linux — ossec](https://github.com/ossec/ossec-hids) - [Логи Linux — ecapture (SSL/TLS)](https://github.com/gojue/ecapture) - [Логи Linux — tracee](https://github.com/aquasecurity/tracee) - [Логи Linux — auditd](https://packages.debian.org/sid/auditd) - [Логи Linux — SysmonForLinux](https://github.com/microsoft/SysmonForLinux) - [Логи Linux — kunai](https://github.com/kunai-project/kunai) - [CTI — OpenCTI](https://github.com/OpenCTI-Platform/opencti) - [CTI — MISP](https://github.com/MISP/MISP) - [Анализ кода](https://github.com/semgrep/semgrep) - [Платформа IR — iris-web](https://github.com/dfir-iris/iris-web) - [Платформа IR — rAIdline](https://github.com/certsocietegenerale/rAIdline) - [Платформа IR — FIR](https://github.com/certsocietegenerale/FIR) - [Задания — DFIR LABS](https://github.com/Azr43lKn1ght/DFIR-LABS) - [Примеры логов — Splunk Attack Range](https://github.com/splunk/attack_range) - [IT — менеджер удалённых подключений — xpipe](https://github.com/xpipe-io/xpipe) - [Безопасность конечных точек — усиление Windows — Harden-Windows-Security](https://github.com/HotCakeX/Harden-Windows-Security) - [Безопасность конечных точек — усиление Linux — lynis](https://github.com/CISOfy/lynis) - [Безопасность конечных точек — Linux — apparmor](https://ubuntu.com/server/docs/apparmor)

### 📦 Прочее

- [Проверка crontab](https://crontab.guru/every-2-minutes) - [markmap.js.org (преобразование markdown в интеллект-карту)](https://markmap.js.org/repl) - [Калькулятор подсетей](https://mxtoolbox.com/subnetcalculator.aspx) - [калькулятор chmod](https://chmod-calculator.com/) - [Конвертер epoch-времени](https://www.epochconverter.com/) - [cyberchef](https://cyberchef.org/) - [Дополнение Chrome для проверок TI](https://chromewebstore.google.com/detail/osintlytics/kfpbbegdghffnakhgcbonaglepgoedmm) - [проверка SMS](https://github.com/mthcht/awesome-lists/blob/main/textverified.com) - [временная почта](https://temp-mail.org) - [10-минутная почта](https://10minutemail.com/)

### Создание контента

- [Создатель анимаций атак — aceresponder](https://aceresponder.com/attackanimator)

### 🏷️ Закладки - ⭐ Закладки со всеми моими списками для импорта в ваш браузер (обновляются автоматически) [ОБНОВИТЬ ЗАКЛАДКИ](https://github.com/mthcht/awesome-lists/blob/main/_utils/bookmarks.html)

awesome-lists

Популярное

Списки безопасности для SOC/DFIR-обнаружений

🐾 Охота за угрозами: