securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

WhacAMole

WhacAMole WhacAMole is a program that analyzes processes in memory in an integral way, detecting and alerting of anomalies related to malware and presenting and saving in files all the relevant information for verification, correlation or analysis, as well as dumping memory regions, processes and...

RPCMon

A GUI tool for scanning RPC communication through Event Tracing for Windows ETW. The tool was published as part of a research on RPC communication between the host and a Windows container. Overview RPCMon can help researchers to get a high level view over an RPC communication between processes. I...

cyberprobe

Cyberprobe The full documentation is at https://cybermaggedon.github.io/cyberprobe-docs/ Summary Cyberprobe is a network packet inspection toolkit Deep Packet Inspection for real-time monitoring of networks. This has applications in network monitoring, intrusion detection, forensic analysis, and ...

RTA

Red Team Arsenal Red Team Arsenal is a inhouse framework created by flipkart security team which monitors the external attack surface of the company's online assets and provide an holistic security view of any security anomalies. It's a closely linked collection of various security engines and...

iMonitorSDK

中文 Introduction iMonitorSDK is a development kit that provides system behavior monitoring for endpoint and the cloud security. It is designed to help industrial applications such as security, endpoint management, and auditing can quickly implement necessary functions without worrying about the...

submonitor

submonitor by xpl0ited1 Description Subdomain monitor with reporting capabilities to Slack, Discord and Telegram Usage: Configure the scanning targets on the targets.txt file, set the reporting config at the config.yaml, then create a cronjob to execute every day crontab -e 0 8 /usr/bin/submonito...

DarkAngel

English | 中文 DarkAngel is a fully automatic white hat vulnerability scanner, which can monitor hacker and bugcrowd assets, generate vulnerability reports, screen capture of vulnerability URL, and send message notifications. DarkAngel download address：github.com/Bywalks/DarkAngel Currently support...

Detours

Microsoft Research Detours Package Detours is a software package for monitoring and instrumenting API calls on Windows. Detours has been used by many ISVs and is also used by product teams at Microsoft. Detours is now available under a standard open source license MIT. This simplifies licensing f...

TwitWork

TwitWork What is TwitWork? Demonstration Require Installation Development setup Download precompiled exe What is TwitWork? Monitor twitter stream. TwitWork use the twitter stream which allows you to have a look at tweets in real-time. There is an input that allows you to filter the flow on one or...

fatt

66 61 74 74 2e fingerprint all the things! More info about the fingerprinting methods, sample use-cases and research results will be added to the repo soon. Stay tuned! A script for extracting network metadata and fingerprints such as JA3 and HASSH from packet capture files pcap or live network...

AndroRAT

AndroRAT Remote Administration Tool for Android Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT Remote Access Tool. It has been developed in a team of 4 for a university project. ...

serverless-prey

Puma Security Serverless Prey Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Functio...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

loboguara

Lobo Guará - Cyber Threat Intelligence Platform Lobo Guará is a platform aimed at cybersecurity professionals, with various features focused on Cyber Threat Intelligence CTI. It offers tools that make it easier to identify threats, monitor data leaks, analyze suspicious domains and URLs, and much...

LSMS

Linux Security and Monitoring Scripts These are a collection of security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Each script works on its own and is independent of other scripts. The scripts can be set up to either...

awesome-threat-detection

Awesome Threat Detection and Hunting A curated list of awesome threat detection and hunting resources Contents Threat Detection and Hunting 🔨 Tools Detection, Alerting and Automation Platforms Endpoint Monitoring Network Monitoring Email Monitoring 🔍 Detection Rules 📑 Dataset 📘 Resources Framewor...

CertEagle

CertEagle - Asset monitoring utility using real time CT log feeds Detailed Description about this can be found here : Read Blog here : https://medium.com/@Asm0d3us/weaponizing-live-ct-logs-for-automated-monitoring-of-assets-39c6973177c7 Introduction In Bugbounties “If you are not first , then you...

RsWindowsThingies

RsWindowsThingies Windows Thingies... but in Rust Tools listenmft Watch an entries' values change. listenmft 0.2.0 Matthew Seyer See the differences in MFT attirbues. USAGE: listenmft.exe OPTIONS FLAGS: -h, --help Prints help information -V, --version Prints version information OPTIONS: -d, --deb...