dmz-security-monitoring-hardening

DMZ Security Monitoring and Hardening CY376: Network Monitoring, Security and Auditing — End-of-Semester Project Blue Team | University of Mines and Technology, Tarkwa Author: Kennedy Kumi Holomah Index number: FCM.41.018.148.23 Student ID: 9013004623 Overview This project builds, secures, and...

scirius

Scirius Introducción Scirius Community Edition es una interfaz web dedicada a la gestión de conjuntos de reglas de Suricata. Maneja el archivo de reglas y los archivos de actualización asociados. .. image:: https://github.com/StamusNetworks/scirius/raw/master/doc/images/suricata-index.png :alt:...

Log4Shell_CVE-2021-44228_related_attacks_IOCs

Log4Shell（CVE-2021-44228）related attacks IOCs Source IPs attempting attacks using Apache Log4j RCE, including a large number of Tor nodes, see Attack-IP.md IOCs for malware, botnets, etc. propagated via the Log4j vulnerability, see IOC-C2.md Snort detection rules, see Snort.md Suricata rules, see...

pingback

Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...

hunting-rules

Suricata Hunting Rules a.k.a. TGI HUNT Suricata rules to assist network anomaly detection. These rules are not performance focused and may perform poorly on high throughput networks. Requires Suricata version 7.0.3 or above. Feedback and suggestions are welcomed here. email blog...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

suricata-vedas

Suricata VEDAS VEDAS-Driven Autonomous Generation of Suricata Rules for CVEs Purpose This repository serves as an open, collaborative validation space for Suricata rules generated autonomously by ARPSyndicate's Vulnerability & Exploit Data Aggregation System VEDAS. While such AI enables rapid,...

Antiphishing

Antiphishing — Inteligencia Predictiva de Phishing para Suricata DONAR · VECTORES DEL PANEL · CONTRIBUIR · ENVIAR UN VECTOR · API REST CTI · WIKI Inteligencia Predictiva de Phishing para Suricata — Defensa Preventiva desde el Día Cero Antiphishing es una infraestructura de Inteligencia de Amenaza...

suricata

Suricata Introduction Suricata is a network IDS, IPS and NSM engine developed by the OISF and the Suricata community. Resources Home Page Bug Tracker User Guide Dev Guide Installation Guide User Support Forum Contributing We're happily taking patches and other contributions. Please see our...

suricata_exporter

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage root@kitploit: $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

SuricataLog

SuricataLog Cuando empecé a aprender cómo usar Suricata, rápidamente descubrí que necesitaba una herramienta para inspeccionar el archivo eve.json; la mayoría de los tutoriales y la documentación disponibles sugerían instalar un stack para realizar las siguientes tareas: 1. Almacenar los registro...

phantom-playbooks

This is the Corelight Repository for Community Playbooks developed for Splunk Phantom. These provide some examples for you to craft your own playbooks. Corelight Investigate DNS Alert This playbook takes a saved search or alert mechanism for DNS from Splunk and pulls the Zeek UID for the alerts. ...

sigint-hombre

sigint-hombre Author: John Page — malvuln aka hyp3rlinx Copyright c 2026 Purpose: Generate derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. Current Version v2.0 • Major...

Zeek-CVE-Enrichment

zeek-cve-enrichment This package enriches the suricatacorelight and notice Corelight logs with known CVE information. To collect the CVE information, it first uses a Python script reformat.py to read a CSV file containing IP addresses, hostnames, and CVE Common Vulnerabilities and Exposures...

pulledpork

PulledPork PulledPork for Snort and Suricata rule management from Google code Find us on Libera.Chat IRC pulledpork Copyright C 2009-2021 JJ Cummings, Michael Shirk and the PulledPork Team! Thank you for choosing to use PulledPork! This file provides some basic guidance on the usage of PulledPork...

pulledpork

PulledPork Herramienta de gestión de reglas para Snort y Suricata desde Google code Encuéntranos en Libera.Chat IRC pulledpork Copyright C 2009-2021 JJ Cummings, Michael Shirk y el equipo de PulledPork. ¡Gracias por elegir PulledPork! Este archivo proporciona una guía básica sobre el uso de...

securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

CVE-2020-3952

Script to check for vulnerable status of CVE-2020-3952 It is inspired from guardicore exploit but with a slight difference: it does NOT create an admin user. It will assess the vulnerable status by validating that the builtin Administrators group can be tainted by creating or appending the harmle...

C2-detection-manjusaka

「Manjusaka」C2フレームワークの検出 C2フレームワークManjusakaの検出: 「SliverとCobalt Strikeの中国版」 参考文献: 検出ロジックの詳細: https://corelight.com/blog/detecting-manjusaka-c2-framework Talosによるレポート: https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html Suricata: Suricataルールはこちらで提供されています...