osint_toolkit

OSINT Toolkit Warning OSINT Toolkit is not production ready yet. This is an early prototype, that still needs some work to be done. A fullstack web application built for security analysts OSINT Toolkit is a self-hostable, on-demand analysis platform designed for security specialists. It...

awesome-threat-intelligence

awesome-threat-intelligence A curated list of awesome Threat Intelligence resources A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that c...

AWS-Threat-Simulation-and-Detection

AWS Threat Detection with Stratus Red Team This repository is a documentation of my adventures with Stratus Red Team - a tool for adversary emulation for the cloud. Stratus Red Team is "Atomic Red Team for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained...

MISP

MISP - Threat Intelligence Sharing Platform MISP is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and IC...

HFish

HFish design concept HFish is a community free honeypot that focuses on enterprise security scenarios. It provides users with independently operable and practical functions from three scenarios: intranet loss detection, internet threat awareness, and threat intelligence production. It increases...

sniffglue

sniffglue sniffglue is a network sniffer written in rust. Network packets are parsed concurrently using a thread pool to utilize all cpu cores. Project goals are that you can run sniffglue securely on untrusted networks and that it must not crash when processing packets. The output should be as...

BlackLotus-Detection

CVE-2022-21894 Public repo for anything CVE-2022-21894 Main page https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ Windows Defender now capable of removing this threat "Possible vulnerable EFI bootloader " Bas...

Zeek-Intelligence-Feeds

Zeek Intel Threat Feed w/ Combined Indicators This is a public feed based on Public Threat Feeds and CRITICAL PATH SECURITY gathered data. This feed will be updated as often as possible. Getting Started These instructions will get you a copy of the project up and running. Dependencies ZEEK 3.0 or...

Sandbox_Scryer

Sandbox Scryer Version: 1.0.4 License: GPL v3 The Sandbox Scryer is an open-source tool for producing threat hunting and intelligence data from public sandbox detonation output The tool leverages the MITRE ATT&CK Framework to organize and prioritize findings, assisting in the assembly of IOCs,...

IOCs

//////////////// ////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // /////////////////////////...

kestrel-lang

.. image:: https://github.com/opencybersecurityalliance/kestrel-lang/raw/develop/logo/logowtext.png :width: 460 :alt: Kestrel Threat Hunting Language |readthedocs| |pypi| |downloads| |codecoverage| |black| | Hunt with Native Query/Script left or Kestrel right? An end-to-end cyber threat hunt...

opensquat

openSquat Core 📑 Table of Contents What is openSquat? Featured In Open-Core Model Key Features Quick Start Requirements Usage Premium and API Modes Configuration Automation CLI Reference Contributing Author License 🎯 What is openSquat? openSquat is an Open Source Intelligence OSINT security tool...

TiEtwAgent

TiEtwAgent - ETW-based process injection detection This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

TelemetrySource

TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. Main Mapping Sheet: Event Mapping Google Sheet Currently mapped sources: Sysmon Window Security Events Microsoft-Windows-Security-Auditing Threat Intelligence Events...

Open-Source-Threat-Intel-Feeds

Free Threat Intel/IOC Feeds This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds a...

ja4

JA4+™ Network Fingerprinting JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

EmailXpose

EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...

tirith

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? curl -sSL https://install.example-cli.dev | bash...