pingback

Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...

ids_bypass

Disclaimer These programs is for Educational purpose ONLY. Do not use it without permission. injectserver: Proof-Of-Concept for CVE-2018-6794. If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy Defensive proof of concept decoy for CVE-2025-59287 WSUS. The decoy emulates WSUS web endpoints on ports 8530 and 8531, captures full HTTP request bodies and headers, stores evidence for forensic analysis, and includes a Windows test harness to validate endpoint, file and process...

phantom-playbooks

This is the Corelight Repository for Community Playbooks developed for Splunk Phantom. These provide some examples for you to craft your own playbooks. Corelight Investigate DNS Alert This playbook takes a saved search or alert mechanism for DNS from Splunk and pulls the Zeek UID for the alerts. ...

tailscale

Tailscale https://tailscale.com Private WireGuard® networks made easy Overview This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees ...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronounced ‘guh-laa’ is an LLM-powered web honeypot designed to mimic various applications and dynamically respond to arbitrary HTTP requests. Galah supports major LLM providers, including OpenAI, GoogleAI, GCP's Vertex AI, Anthropic, Cohere, and Ollama. Unlike traditional...

sigint-hombre

sigint-hombre Author: John Page — malvuln aka hyp3rlinx Copyright c 2026 Purpose: Generate derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. Current Version v2.0 • Major...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, email messages, and binary files. Features include Suricata network analysis with tshark adding the protocols Suricata doesn't parse, YARA binary...

wazuh-home-soc

Home SOC: Threat Detection Lab with Wazuh + Suricata A self-hosted Security Operations Center lab built to detect real attack techniques against a deliberately vulnerable target, using Wazuh as the SIEM and Suricata as a network-based IDS sensor. Built to demonstrate detection engineering skills ...

threat-intel

threat-intel This repository contains IoCs related to Volexity public threat intelligence blog posts. Public blog posts related to these IoCs can be found on the Volexity website. In the past this repository was also used to store tools published by Volexity. These tools have now been moved into...

Corelight-Ansible-Roles

Corelight-Ansible-Roles Caution: Before you run this version, if you are upgrading, some variable names and locations have changed To get started, simply run this command: source curl https://raw.githubusercontent.com/corelight/Corelight-Ansible-Roles/main/download-run-me-first.sh This product...

CVE-2017-5638_struts

I extended Scott Campbell's script further, made it more complicated : While "HTTPStrutsAttack" will stop 100% of the recon, there was still miniscule chance that if a scanner hits a vulnerable system, even though we'd block the scanner, vulnerable system might still do the wget included in the...

SuricataLog

SuricataLog When I started learning how to use Suricata quickly found that I needed a tool to inspect the eve.json file; Most of the tutorials and documentation out there suggested installing a stack to do the following tasks: 1. Store the logs in a central location 2. Normalize and enrich the...

suricata_exporter

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -versio...

c2detect

c2detect Fingerprint the C2 server behind the beacon. Point it at network telemetry and it names the command-and-control framework — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel, and 11+ more — with a confidence score and the exact indicators that matched. -success Blue-team / defensive:...

suricata-vedas

VEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for CVEs This repository is an open, collaborative validation space for CVE detection content: Suricata rules : network detection of exploitation attempts. Nuclei templates : active, non-destructive checks for...

vedas-signatures

VEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for CVEs This repository is an open, collaborative validation space for CVE detection content: Suricata rules : network detection of exploitation attempts. Nuclei templates : active, non-destructive checks for...

vmware_vcenter_cve_2020_3952

Proof of concept for CVE-2020-3952 This is a short piece of code that exploits of CVE-2020-3952, which is described in detail at the Guardicore Labs post over here. This vulnerability was published by VMware in April 2020 with a maximum CVSS score of 10.0. It allows an attacker with a network...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts Suricata LUA scripts to detect CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, and CVE-2019-12260 CVE-2019-12255 The script checks for CVE-2019-12255, the packet that is checked needs to have the PSH, ACK, and URG flags set, and have a payload size that exceeds 1500...

Antiphishing

Antiphishing — Predictive Phishing Intelligence for Suricata DONATE · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero Antiphishing is an open-source GPLv3 Cyber Threat Intelligence CTI...