Elasticsearch_rules

Elasticsearchrules ElasticSearch Detection version of SOC prime watcher rules with some new Corelight rules Please note some of these rules should be tuned to your environment. To load in Elastic, download the ndjson and expand Security and go to alerts. Click on Managed Alerts and click import...

WAMpage

WAMpage WAMpage - A WebOS root LPE exploit chain CVE-2022-23731 This exploit is mainly of interest to other researchers - if you just want to root your TV, you probably want RootMyTV, which offers a reliable 1-click persistent root. Currently only supports WebOS 4.x on 32-bit SoCs. This software ...

arya

Arya - The Reverse YARA Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA because it does exactly the opposite - it creates files that matches your rules. You can read more about Arya and how it works in our blog. Intro...

Sooty

Visión general Sooty es una herramienta desarrollada con la tarea de ayudar a los analistas de SOC a automatizar parte de su flujo de trabajo. Uno de los objetivos de Sooty es realizar tantas comprobaciones rutinarias como sea posible, permitiendo al analista más tiempo para un análisis más...

CVE-2026-48907-Joomla-JCE-detection

Joomla JCE CVE-2026-48907 — Validación de PoC, Artefactos de Webshell y Detección para SOC Informe de validación defensiva y notas de detección orientadas a SOC para CVE-2026-48907 que afecta a Joomla Content Editor JCE versiones hasta 2.9.99.4. Propósito del repositorio Este repositorio document...

offensive-security-adversary-emulation

Project 5 — Offensive Security & Adversary Emulation Part of a 5-project home-lab SOC arc: build → detect & enrich → investigate → monitor & hunt → attack & cross-check. This project adds the missing half of the picture from Projects 1–4: everything before this was blue team building detections,...

soc-investigation-lab

End-to-End SOC Investigation Lab Executes a complete four-phase attack chain Reconnaissance → Exploitation → Persistence → Exfiltration against Metasploitable2, collects evidence at each phase, and produces a structured incident timeline and SOC report — demonstrating simultaneous attacker and...

netsentryx

NetSentryx PRO 🛡️ Motor de Detección de Amenazas y Observabilidad de Red en Tiempo Real de Alto Rendimiento Impulsado por IA NetSentryx PRO es una plataforma de inteligencia de amenazas y monitoreo de red basada en eventos de próxima generación. Combinando firmas basadas en reglas con un...

sweyntooth_bluetooth_low_energy_attacks

SweynTooth - Unleashing Mayhem over Bluetooth Low Energy This repository is part of a research outcome from theASSET Research Group. SweynTooth captures a family of 18 vulnerabilities across different Bluetooth Low Energy BLE software development kits SDKs of six major system-on-a-chip SoC vendor...

home_SOC_suite

Home SOC Suite — Night's Watch Un Centro de Operaciones de Seguridad SOC personal construido desde cero durante un programa de reentrenamiento en Anwendungsentwicklung. Esta suite monitorea un endpoint Windows en busca de anomalías de red, picos de recursos, ejecución de procesos, cambios en el...

soc-analyst-hub

🛡️ SOC Analyst Hub — Kit de herramientas para Analistas de Nivel 1 Un kit interactivo gratuito y completamente offline para analistas de SOC de Nivel 1 — que cubre respuesta a incidentes, triaje de alertas, caza de amenazas e incorporación de analistas. Cero dependencias. Un único archivo HTML...

lg-webos-kexec

lg-webos-kexec Boot a custom Linux kernel on a rooted LG webOS TV via kexec — in RAM, no secure-boot bypass. Status: work-in-progress. A custom kernel can be staged and reaches userspace, but it does not yet stay up as a usable OS. Target LG 50UP81009LR webOS 6.5, Realtek RTD2875, armv7l. Rooted...

wazuh-home-soc

Home SOC: Threat Detection Lab with Wazuh + Suricata A self-hosted Security Operations Center lab built to detect real attack techniques against a deliberately vulnerable target, using Wazuh as the SIEM and Suricata as a network-based IDS sensor. Built to demonstrate detection engineering skills ...

soc-investigation-powershell-edrfreeze

PowerShell EDRFreeze Investigation LetsDefend Case Study This repository contains a documented SOC investigation based on a LetsDefend scenario involving suspicious PowerShell activity, a GitHub-hosted payload, and execution of the EDRFreeze tool. What this repository includes Full report:...

APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetry

Large language model LLM agents could help security operations centers SOCs investigate advanced persistent threats APTs by turning weak leads into evidence for intrusion scoping and response. Yet success under one telemetry setting does not establish robustness to changes in log collection,...

Playbooks

Table of Content TOC IR Playbooks This repository contains all the Incident Response Playbooks and Workflows of Company's SOC. Each folder contains a Playbook that is broken down into 6 section as per NIST - 800.61 r2 1- Preparation This section should include the following informations List of A...

FreeLabFriday_Labs

Welcome to the Free Lab Friday Lab Platform! Need 1 lab?? Maybe 2???? Well we've got 200+ so go crazy! This repository contains all lab instructions for the following content: Information Security Core Skills SOC Core Skills Active Defense & Cyber Deception SOC Analyst Labs Backdoors & Breaches...

SOC-Analyst-Portfolio

🛡️ Allen Ace SOC Analyst | Threat Hunter | Detection Engineer Detect • Investigate • Respond • Defend Welcome This portfolio documents my hands-on cybersecurity journey through practical investigations, enterprise lab environments, detection engineering, digital forensics, malware analysis, threat...

IntelligentProcessLifecycle

IntelligentProcessLifecycle The Intelligent Process Lifecycle of Active Cyber Defenders Description This github hosts the poster related files of false positive and error categories in security operation services. The goal is to define an open source reporting standard for Security Operation Cent...

PT-2026-98094

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thermal driver for Tegra SoC where the tegra soctherm remove function fails to call thermal cooling device unregister for registered cooling devices. This results ...