threat-intel

threat-intel This repository contains IoCs related to Volexity public threat intelligence blog posts. Public blog posts related to these IoCs can be found on the Volexity website. In the past this repository was also used to store tools published by Volexity. These tools have now been moved into...

ioc

IoC Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs. Licenses The content of this repository is released under the Detection Rule License DRL 1.1...

threat-intel

threat-intel This repository contains supplemental items including IOCs, and signatures discussed in Huntress blogposts, and other media. Organization This repository is organized by year, within that folder will be a subfolder named by the month and title of the media which is supported by its...

ws4-secure-design-agentic-systems

CoSAI Workstream 4: Secure Design Patterns for Agentic Systems This repository is for the work of the CoSAI Workstream 4, Secure Design Patterns for Agentic Systems. CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry leading organizations dedicated to...

LogonTracer

Concept LogonTracer v2 is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a host name or an IP address and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which...

drs-malware-scan

Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints. Signature-based antivirus alone is insufficient as moder...

tpotce

T-Pot - The All In One Multi Honeypot Platform T-Pot is the all in one, optionally distributed, multiarch amd64, arm64 honeypot plattform, supporting 20+ honeypots and countless visualization options using the Elastic Stack, animated live attack maps and lots of security tools to further improve...

IRM

IRM-2022 Incident Response Methodologies 2022 CERT Societe Generale with the collaboration of CERT aDvens provides easy to use operational incident best practices. These cheat sheets are dedicated to incident handling and cover multiple fields in which a CERT team can be involved. One IRM exists...

threagile

Threagile Agile Threat Modeling Toolkit Threagile see threagile.io for more details is an open-source toolkit for agile threat modeling: It allows to model an architecture with its assets in an agile fashion as a YAML file directly inside the IDE. Upon execution of the Threagile toolkit all...

LOLRMM

LOLRMM - Living Off the Land Remote Monitoring and Management 🖥️🔍 Welcome to LOLRMM Living Off the Land Remote Monitoring and Management, a community-driven project that provides a curated list of Remote Monitoring and Management RMM and remote access tools that could potentially be abused by...

bumblebee

Threat Intelligence Exposure Catalogs Maintained exposure catalogs for recent supply-chain campaigns, built from public threat-intelligence reporting with Perplexity Computer and updated via PRs as fresh campaigns are reported. Pass a catalog to a scan with --exposure-catalog . Review the entries...

CVE-2024-49138-SOC-Investigation

CVE-2024-49138 Exploitation Investigation Platform: LetsDefend SOC Training Environment Alert: SOC335 - CVE-2024-49138 Exploitation Detected Category: Privilege Escalation | Malware Analysis | Incident Response Status: Investigation Completed ✅ Overview In this investigation, I worked on an alert...

osint_toolkit

OSINT Toolkit Warning OSINT Toolkit is not production ready yet. This is an early prototype, that still needs some work to be done. A fullstack web application built for security analysts OSINT Toolkit is a self-hostable, on-demand analysis platform designed for security specialists. It...

RedHunt-OS

RedHunt Linux Distribution VM v2 Virtual Machine for Adversary Emulation and Threat Hunting by RedHunt Labs RedHunt OS aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats...

EmailXpose

EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...

enterpriseattack

enterpriseattack - MITRE's Enterprise ATT&CK® A lightweight Python module to interact with the MITRE ATT&CK Enterprise dataset. Built to be used in production applications due to it's speed and minimal depedancies. Read the docs for more info. MITRE ATT&CK® MITRE ATT&CK® is a globally-accessible...

APT-Hunter

APT-Hunter Threat hunting for Windows event logs, built with a purple-team mindset. APT-Hunter is a threat hunting tool for Windows event logs. It uses pre-defined detection rules and log statistics to surface APT activity hidden in large volumes of events, cutting the time needed to uncover...

awesome-wazuh

awesome-wazuh Curated list of Wazuh resources, tools, and integrations Wazuh is a free, open-source security monitoring platform for threat prevention, detection, and response. Contents Official Documentation Getting Started Setup Guides Deployment Docker Kubernetes Terraform / OpenTofu Ansible...

sniffglue

sniffglue sniffglue is a network sniffer written in rust. Network packets are parsed concurrently using a thread pool to utilize all cpu cores. Project goals are that you can run sniffglue securely on untrusted networks and that it must not crash when processing packets. The output should be as...

awesome-threat-intelligence

awesome-threat-intelligence A curated list of awesome Threat Intelligence resources A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that c...