joy

| |/ | | | | | | | || |/ |/ , | |/ | / root@kitploit: A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring. TLS Fingerprinting Addendum: For our most recent network fingerprinting tools and data, please see Mercury...

ZeroScout

🦅 ZeroScout The Autonomous Local & Cloud Threat Hunter "Don't just scan files. Visualize the battlefield." 🇹🇷 Türkçe Dökümantasyon İçin Tıklayın Read in Turkish 🚀 What is ZeroScout? ZeroScout is a next-generation threat hunting framework designed for Incident Responders DFIR , SOC Analysts , and...

elastic-peak-dashboards

PEAK Baseline Threat Hunt Dashboards Kibana / Security Onion 3.0 — Tier 1 & ICS Protocol Analysis Importable Kibana saved-object dashboards implementing the Splunk PEAK Baseline Threat Hunt methodology for cyber threat hunt CTH and incident response IR operations. Built and validated against...

HELK

HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...

kestrel-lang

.. image:: https://github.com/opencybersecurityalliance/kestrel-lang/raw/develop/logo/logowtext.png :width: 460 :alt: Kestrel Threat Hunting Language |readthedocs| |pypi| |downloads| |codecoverage| |black| | Hunt with Native Query/Script left or Kestrel right? An end-to-end cyber threat hunt...

agentic-threat-hunting-framework

Agentic Threat Hunting Framework ATHF Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework ATHF is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence,...

Tylium

Tylium Primary data pipelines for intrusion detection, security analytics and threat hunting These files contain configuration for producing EDR endpoint detection and response data in addition to standard system logs. These configurations enable the production of these data streams using F/OSS...

Threat-Hunting

Threat-Hunting | Detection Engineering Collection of threat hunting and detection queries for: CrowdStrike Falcon using CQL – CrowdStrike Query Language Microsoft Defender XDR using KQL – Kusto Query Language Aimed at surfacing suspicious processes, anomalous network behaviors, living-off-the-lan...

Red-Teaming-Toolkit

Red Teaming Toolkit This repository contains cutting-edge open-source security tools OST that will help you during adversary simulation and as information intended for threat hunter can make detection and prevention control easier. The list of tools below that could be potentially misused by thre...

persisthunt

Linux Persistence Detection, Hunting and Artifact Collection Summary Usage Example Detections Table of Techniques Summary persisthunt.sh helps speed up investigations by collecting targeted persistence-related artifacts and highlighting suspicious patterns commonly associated with Linux persisten...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

strelka

Releases | Documentation | Pull Requests | Issues !Pull...

Crawlector

Crawl e ctor Crawlector the name Crawlector is a combination of Crawl er & Detector is a threat-hunting framework designed for scanning websites for malicious objects. Note-1 : The framework was first presented at the No Hat conference in Bergamo, Italy on October 22nd, 2022 Slides, YouTube...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Sample EVTX files are in the .\evtx directory Note If your antivirus freaks out after...

APT-Hunter

APT-Hunter APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity . APT-Hunter use pre-defined detection rules and focus on statistics to uncover...

ThreatHunting-JupyterNotebooks

🟣 Weekly Purple Team - Threat Hunting Notebooks A collection of threat hunting and detection engineering Jupyter notebooks accompanying the Weekly Purple Team YouTube channel. Each notebook provides detection logic to help security professionals understand both offensive techniques and defensive...

aether

Aether version : 0.9 stable release Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatical...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

kunai

Leitmotiv Kunai is a powerful tool designed to bring actionable insights for tasks such as security monitoring and threat hunting on Linux systems. Think of it as the Linux counterpart to Sysmon on Windows, tailored for comprehensive and precise event monitoring. Why Kunai Stands Out...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...