Security lists for SOC/DFIR detections

🐾 威胁狩猎：

威胁狩猎搜索

📂 我的检测列表

📋 列表：https://github.com/mthcht/awesome-lists/tree/main/Lists
🕵️‍♂️ 威胁狩猎指南：https://mthcht.medium.com/list/threat-hunting-708624e9266f
🚰 可疑命名管道：suspicious_named_pipe_list.csv
🌐 可疑 TLD（自动更新）：[suspicious_TLDs]
🌐 可疑 ASN（自动更新）：[suspicious ASNs]
🌐 供参考：Maxmind GeoIP 数据库（自动更新）：GeoIP DB
🆔 OAuth 可疑应用 ID：OauthSentry
🔧 可疑 Windows 服务：suspicious_windows_services_names_list.csv
⏲️ 可疑 Windows 计划任务：suspicious_windows_tasks_list.csv
🚪 可疑目标端口：suspicious_ports_list.csv
🛡️ 可疑防火墙规则：suspicious_windows_firewall_rules_list.csv
🆔 可疑用户代理：suspicious_http_user_agents_list.csv
🔏 可疑证书签名者：[suspicious CERTS]
📇 可疑 USB ID：suspicious_usb_ids_list.csv
🏷️ 可疑互斥体名称：suspicious_mutex_names_list.csv
🔢 可疑 MAC 地址：suspicious_mac_address_list.csv

我会在分析我的 detection keywords 项目中的每个工具后定期更新这些列表中的大多数

其他列表

🛡️ DFIR：

🚫 IOC 源/黑名单：

🐙 Github

更多 github 列表

🖥️ SIEM/SOC/紫队相关：

- [EDR Telemetry](https://github.com/tsale/EDR-Telemetry) - [PurpleTeam Scripts](https://github.com/mthcht/Purpleteam) - [Awesome-SOC](https://github.com/cyb3rxp/awesome-soc) - [Awesome SOC analyst](https://github.com/st0pp3r/awesome-soc-analyst) - [Threat-Hunting with Splunk](https://github.com/mthcht/ThreatHunting-Keywords) - [Detection Lists](https://github.com/mthcht/awesome-lists/Lists) - [PurpleTeam atomics](https://github.com/redcanaryco/atomic-red-team)

📊 TI TTP/框架/模型/追踪器

🕵️‍♂️ 调查

📊 TI 检查

🔬 沙箱 / 仿真

🧩 数据处理

📡 检测资源

🌐 安全新闻

- [Adam Chester 博客订阅源](https://blog.xpnsec.com/rss.xml) - [ahnlab APT 订阅源](https://asec.ahnlab.com/en/category/apt-en/feed/) - [ahnlab CERT 订阅源](https://asec.ahnlab.com/en/category/cert-en/feed) - [ahnlab 钓鱼攻击订阅源](https://asec.ahnlab.com/en/category/phishing-scam-en/feed) - [ahnlab 趋势订阅源](https://asec.ahnlab.com/en/category/trend-en/feed) - [Akamai 博客订阅源](https://feeds.feedburner.com/akamai/blog) - [Any.run 恶意软件分析博客订阅源](https://any.run/cybersecurity-blog/category/malware-analysis/feed/) - [Avast 博客订阅源](https://blog.avast.com/rss.xml) - [badsectorlabs 上周安全动态 - 红队](https://blog.badsectorlabs.com/feeds/all.atom.xml) - [bi-zone 博客订阅源](https://medium.com/feed/@bi-zone) - [Bitdefender 实验室订阅源](https://www.bitdefender.com/nuxt/api/en-us/rss/labs/) - [Binary Defense 博客订阅源](https://www.binarydefense.com/feed/) - [BlackBerry 博客](https://blogs.blackberry.com/en/home) - [BleepingComputer 订阅源](https://www.bleepingcomputer.com/feed/) - [BleepingComputer 订阅源](https://www.bleepingcomputer.com/feed/) - [Broadcom 博客订阅源](https://sed-cms.broadcom.com/rss/v1/blogs/rss.xml) - [CERT FR 警报](https://www.cert.ssi.gouv.fr/alerte/) - [CERT FR 公告](https://www.cert.ssi.gouv.fr/avis/) - [CERT LV 订阅源](https://cert.lv/en/feed/rss/all) - [CERT PL 订阅源](https://cert.pl/en/rss.xml) - [CERT SE 订阅源](https://www.cert.se/feed.rss) - [CERT SI 订阅源](https://www.cert.si/en/category/news/feed/) - [CERT UA 订阅源](https://cert.gov.ua/api/articles/rss) - [CERT-FR](https://www.cert.ssi.gouv.fr/) - [Check Point 研究订阅源](https://research.checkpoint.com/feed) - [CIRT BD 订阅源](https://www.cirt.gov.bd/feed/) - [CISA 新闻订阅源](https://www.cisa.gov/cybersecurity-advisories/all.xml) - [CISA 新闻](https://www.cisa.gov/news-events/news) - [Cisco Talos](https://www.talosintelligence.com/) - [Claroty Team82 研究](https://claroty.com/team82/research/) - [Cloudfare 安全订阅源](https://blog.cloudflare.com/tag/security/rss) - [Clément Notin 订阅源](https://clement.notin.org/feed.xml) - [CrowdStrike 反对手行动博客](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) - [Deep Instinct 博客](https://www.deepinstinct.com/blog) - [detect.fyi](https://detect.fyi/) - [检测工程周刊](https://www.detectionengineering.net/) - [DFIR 每周新闻](https://thisweekin4n6.com/) - [DFIR 每周新闻订阅源](https://thisweekin4n6.wordpress.com/feed/) - [Dr.Web 病毒警报订阅源](https://news.drweb.com/rss/get/?c=9) - [EclecticIQ 威胁情报](https://www-eclecticiq-com.sandbox.hs-sites.com/blog?type=intelligence-research#overview) - [Elastic 安全实验室博客](https://www.elastic.co/security-labs) - [Elastic 安全实验室博客订阅源](https://www.elastic.co/security-labs/rss/feed.xml) - [EricaZelic 博客](https://ericazelic.medium.com/) - [Forcepoint 实验室博客](https://www.forcepoint.com/blog/x-labs) - [Genians 威胁情报订阅源](https://www.genians.co.kr/blog/threat_intelligence/rss.xml) - [gi7w0rm 威胁情报订阅源](https://medium.com/feed/@gi7w0rm) - [Google Project Zero 博客订阅源](https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss) - [Google 威胁情报订阅源](https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v) - [Google 威胁情报](https://cloud.google.com/blog/topics/threat-intelligence) - [Google 威胁分析订阅源](https://blog.google/threat-analysis-group/rss/) - [Group-IB 订阅源](https://blog.group-ib.com/rss.xml) - [HackerNews 订阅源](https://feeds.feedburner.com/TheHackersNews) - [HarfangLab 实验室订阅源](https://harfanglab.io/insidethelab/feed/) - [Hexacorn 博客订阅源](http://www.hexacorn.com/blog/feed/) - [Horizon3 订阅源](https://www.horizon3.ai/feed/) - [hunt.io 博客](https://hunt.io/blog) - [Huntress 博客订阅源](https://www.huntress.com/blog/rss.xml) - [IC3 CSA 订阅源](https://www.ic3.gov/CSA/rss) - [Infostealers Hub 新闻订阅源](https://www.infostealers.com/learn-info-stealers/feed/) - [Infostealers 报告订阅源](https://www.infostealers.com/info-stealers-reports/feed/) - [Intrinsec 订阅源](https://www.intrinsec.com/feed/) - [ISC SANS EDU 订阅源](https://isc.sans.edu/rssfeed.xml) - [JPCERT 订阅源](https://blogs.jpcert.or.jp/en/atom.xml) - [JPCERT](https://www.jpcert.or.jp/english/) - [Krebs on Security 订阅源](https://krebsonsecurity.com/feed/) - [Malwarebytes 博客订阅源](https://www.malwarebytes.com/blog/feed/index.xml) - [MalwareTech 订阅源](https://www.malwaretech.com/feed) - [Mauricio Velazco 博客](https://medium.com/@mvelazco) - [McAfee Labs 订阅源](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/feed/) - [Michael Haag 博客](https://haggis-m.medium.com/) - [Microsoft 安全博客订阅源](https://www.microsoft.com/en-us/security/blog/feed/) - [Microsoft 事件响应忍者中心](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/welcome-to-the-microsoft-incident-response-ninja-hub/4243594) - [Microsoft 威胁情报订阅源](https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed) - [Morphisec 威胁研究](https://blog.morphisec.com/topic/threat-research) - [NCC Group 研究订阅源](https://research.nccgroup.com/feed/) - [NCC Group 研究博客 - 安全](https://www.nccgroup.com/us/research-blog/?resource=18345&category=18146#hub) - [NCSC 新闻订阅源](https://feeds.english.ncsc.nl/news.rss) - [NIST CVE 列表](https://nvd.nist.gov/vuln/search/results?isCpeNameSearch=false&results_type=overview&form_type=Basic&search_type=all&startIndex=0) - [NIST 网络安全洞察订阅源](https://www.nist.gov/blogs/cybersecurity-insights/rss.xml) - [攻击性研究 - INJECT 的 DSAS](https://blog.injectexp.dev/) - [Orange Cyberdefense 情报](https://www.orangecyberdefense.com/global/blog?tx_solr%5Bfilter%5D%5B0%5D=tags%3AIntelligence-led+Security) - [Outpost24 研究与威胁情报订阅源](https://outpost24.com/blog/category/research-and-threat-intel/feed/) - [Proofpoint 威胁洞察](https://www.proofpoint.com/us/blog/threat-insight#) - [Qualys 威胁研究订阅源](https://blog.qualys.com/vulnerabilities-threat-research/feed) - [Red Canary 订阅源](https://www.redcanary.co/feed/) - [ReversingLabs 威胁研究](https://www.reversinglabs.com/blog/tag/threat-research) - [SANS 博客](https://www.sans.org/blog/) - [Security.com 威胁情报](https://www.security.com/threat-intelligence) - [SecurityAffairs APT 订阅源](https://securityaffairs.com/category/apt/feed) - [SecurityWeek 订阅源](https://www.securityweek.com/feed/) - [securlist APT 定向攻击订阅源](https://securelist.com/threat-category/apt-targeted-attacks/feed/) - [Sekoia 博客](https://blog.sekoia.io/) - [Sekoia 博客订阅源](https://blog.sekoia.io/feed/) - [SentinelOne 实验室订阅源](https://www.sentinelone.com/labs/feed/) - [Seqrite 技术博客](https://www.seqrite.com/blog/category/technical/) - [Simone Kraus 博客订阅源](https://medium.com/feed/@simone.kraus) - [Sophos 威胁研究订阅源](https://news.sophos.com/en-us/category/threat-research/feed/) - [SpecterOps 订阅源](https://posts.specterops.io/feed) - [Splunk 研究博客](https://www.splunk.com/en_us/blog/author/secmrkt-research.html) - [网络安全新闻订阅源](https://cybersecuritynews.com/feed/) - [Talos 订阅源](https://feeds.feedburner.com/feedburner/Talos) - [Tenable 博客](https://medium.com/tenable-techblog) - [The HackerNews 订阅源](https://feeds.feedburner.com/TheHackersNews) - [The DFIR Report 订阅源](https://thedfirreport.com/feed/) - [ThreatConnect 博客订阅源](https://threatconnect.com/blog/feed/) - [ThreatLabz Zscaler 博客](https://threatlabz.zscaler.com/blogs) - [Threatpost 订阅源](https://threatpost.com/feed/) - [趋势科技安全订阅源](http://feeds.trendmicro.com/TrendMicroSimplySecurity) - [Trustwave 博客订阅源](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rss.xml) - [Twitter](https://twitter.com/home) - [Unit42 订阅源](http://feeds.feedburner.com/Unit42) - [Unit42 订阅源](https://unit42.paloaltonetworks.com/feed/) - [Virus Bulletin 订阅源](https://www.virusbulletin.com/rss) - [Virus Bulletin](https://www.virusbulletin.com/virusbulletin/) - [Volexity 博客订阅源](https://www.volexity.com/blog/feed/) - [WeLiveSecurity 订阅源](https://www.welivesecurity.com/en/rss/feed/) - [tl;dr sec 时事通讯](https://tldrsec.com/)

📺 YouTube/Twitch 频道

🎙️ 播客

💬 Discord /Slack 频道

📚 培训

DFIR

13cubed - 调查 Windows 端点 13cubed.com - Windows 端点
13cubed - 调查 Windows 内存 13cubed.com - Windows 内存
13cubed - 调查 Linux 设备 13cubed.com - Linux
SANS：FOR500
SANS：FOR508
Defensive-security：Linux 实时取证
@0gtweet - 取证课程：精通 Windows 取证
@DebugPrivilege：免费取证调试课程 InsightEngineering
挑战：
- Arsenal Recon 面向 DFIR 的磁盘镜像：公开可用的磁盘镜像
- @inversecos - APT 模拟实验室：xintra
- @TheDFIRReport：包含现有报告日志的实验室 dfir-labs
- @ACEresponder：提供详细讲解和实验室的课程 aceresponder.com
- @binaryz0ne：带数据集的 DFIR 挑战数据集 + Linux 取证工作坊

SOC

tryhackme - SOC 一级

📚 书籍

DFIR

SOC

📚 知识站点

🧪 实验室

📦 其他

内容创作

攻击动画制作器 - aceresponder

🏷️ 书签

⭐ 包含我所有列表的书签，可导入你的浏览器（自动更新）更新书签

awesome-lists

最受欢迎

攻击性

挑战

逆向工程 / 恶意软件分析 / 深入剖析

深入探讨

漏洞利用

AI