awesome-lists

SOC/DFIR検知のためのセキュリティリスト 🐾 脅威ハンティング: ThreatHunting keywords サイト ThreatHunting keywords リスト ThreatHunting Yara ルール ThreatHunting 検索 Windows サービス検索 User-Agents 検索 DNS Over HTTPS 検索 不審なTLD検索 HijackLibs 検索 フィッシング＆DNSTWIST 検索 ブラウザ拡張機能の検索 見え透いた場所に隠れるC2 HTMLスマグリングアーティファクト PSEXECおよび類似ツールの検索 Time Slipping検...

detections

detections これは、お使いの環境で悪意のある活動を検知するのに役立つ可能性のある情報をまとめたリポジトリです。 網羅的なものではありません。ご自身の責任でご利用ください（結果は必ず検証してください！）...

Azure-Sentinel

Microsoft Sentinel および Microsoft 365 Defender Microsoft Sentinel と Microsoft 365 Defender の統合リポジトリへようこそ！このリポジトリには、すぐに使える検出、探索クエリ、ハンティングクエリ、ブック、プレイブックなどが含まれており、Microsoft Sentinel の導入を迅速に進め、環境を保護して脅威を追跡するためのセキュリティコンテンツを提供します。ハンティングクエリには、Microsoft 365 Defender および Microsoft Sentinel...

Security-Detections-MCP

Security Detections MCP LLM이 Sigma , Splunk ESCU , Elastic , KQL , Sublime , CrowdStrike CQL 보안 탐지 규칙의 통합 데이터베이스를 질의할 수 있게 해주는 MCPModel Context Protocol 서버입니다. 처음이신가요?설정 가이드부터 시작하세요 -- macOS, WindowsWSL 및 네이티브, Linux를 단계별로 다룹니다. 호스팅된 버전을 원하시나요? 설치를 완전히 생략하세요:호스팅 MCP 설정 가이드 두 가지 실행 방법 로컬 모든 기능 — 지...

spraykatz

Spraykatz Spray love around the world Index Title| Description ---|--- About| Brief Description about the tool Installation| Installation and Requirements Usage| How to use Spraykatz Changelog| Spraykatz changelog Acknowlegments| Acknowlegments About Spraykatz is a tool without any pretention abl...

analyzer

This project automates the daily tasks of Threat Intelligence Analyzer role internally without external resources' interaction. It analyzes, visualizes and structures sensitive files Malware or data by extracting features, artifacts and IoC using different modules. The output of those modules can...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

kraken

Kraken is a simple cross-platform Yara scanner that can be built for Windows, Mac, FreeBSD and Linux. It is primarily intended for incident response, research and ad-hoc detections not for endpoint protection. Following are the core features: Scan running executables and memory of running process...

fixing-google-secops-detections

Google SecOps Chronicle Curated Detections: Flaw Analysis & Tuning This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps Chronicle Curated Detections. While Google Threat Intelligence GTIG provides exceptional conceptual threat...

plague

plague EDR向けデフォルト検知 以下に詳述する検知は、私が導入または関わるあらゆるEDR製品に確立しようとしているものです。重要度やデータセットについては、ご自身の考慮事項を踏まえてください。 検知の実現方法については、こちらの投稿を参照してください https://www.goblinloot.net/2023/02/writing-detections-when-stuck-with-edr.html?m=1 センサーやその他のセキュリティ製品の改ざん...

The Fine Art of Frustrating the Adversary

For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. Deception techniques such as honeypot accounts, false infrastructure, and tarpits can slow adversaries down while giving defenders earlier...

detection-rules dev-v2.2.0

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

detection-rules dev-v2.1.0

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

FOMO in the SOC: Where AI Platforms like Claude Actually Fit

AI is moving incredibly fast, and every security leader is feeling the pressure to keep up. AI platforms like Claude, Codex and Cursor are already helping security teams write detections, investigate alerts, summarize incidents, and automate repetitive work. The conversation has evolved from...

Cybersecurity Detection Classification with Reasoning-Enabled Language Models

A major issue in Security Operations Centers SOCs is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models LLMs to emit a triage label directly, but does not train them to reason about whether a...

Daylight Security Launches Detection Program Visibility

Daylight Security adds Detection Program Visibility to unify detections, map coverage to MITRE ATT&CK, and help MDR customers spot gaps and improve results...

Why Modern SOCs Need Multi-Layered Detections

The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely. The CrowdStrike...

Fig Expands SecOps Engineering Lifecycle as Security Teams Seek More Resilient Infrastructure

Learn how Fig adds testing, deployment, and continuous verification to SecOps, helping security teams keep detections reliable as infrastructure evolves. daily...

CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

Overview On July 14, 2026, Microsoft published a security advisory addressing CVE-2026-58644, a critical remote code execution RCE vulnerability affecting on-premises Microsoft SharePoint Server deployments. The vulnerability, which carries a CVSS v3.1 score of 9.8 Critical, results from the...

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...