aether

Aether version : 0.9 stable release Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatical...

Threat-Hunting

Threat-Hunting | Detection Engineering Collection of threat hunting and detection queries for: CrowdStrike Falcon using CQL – CrowdStrike Query Language Microsoft Defender XDR using KQL – Kusto Query Language Aimed at surfacing suspicious processes, anomalous network behaviors, living-off-the-lan...

Sandbox_Scryer

Sandbox Scryer Version: 1.0.4 License: GPL v3 The Sandbox Scryer is an open-source tool for producing threat hunting and intelligence data from public sandbox detonation output The tool leverages the MITRE ATT&CK Framework to organize and prioritize findings, assisting in the assembly of IOCs,...

Judge-Jury-and-Executable

Judge Jury and Executable A Threat Hunting Forensics Tool Features: Scan a mounted filesystem for threats right away Or gather a system baseline before an incident, for extra threat hunting ability Can be used before, during or after an incident For one to many workstations Scans the MFT, bypassi...

fastfinder

FastFinder A lightweight incident response tool for threat hunting and forensic triage ✨ Overview FastFinder is a powerful, lightweight incident response tool designed for cybersecurity professionals conducting threat hunting, live forensics, and endpoint triage. Built for both Windows and Linux...

Adama

Adama Searches For Threat Hunting and Security Analytics A collection of known log and / or event data searches for threat hunting and detection. They enumerate sets of searches used across many different data pipelines. Implementation details are for ELK. Adama is part of the SpaceCake project...

Douglas-042

Douglas-042 - Threat Hunting Incident Response - PowerShell Hunting DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the...

persisthunt

Linux Persistence Detection, Hunting and Artifact Collection Summary Usage Example Detections Table of Techniques Summary persisthunt.sh helps speed up investigations by collecting targeted persistence-related artifacts and highlighting suspicious patterns commonly associated with Linux persisten...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

kunai

Leitmotiv Kunai is a powerful tool designed to bring actionable insights for tasks such as security monitoring and threat hunting on Linux systems. Think of it as the Linux counterpart to Sysmon on Windows, tailored for comprehensive and precise event monitoring. Why Kunai Stands Out...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

Crawlector

Crawl e ctor Crawlector the name Crawlector is a combination of Crawl er & Detector is a threat-hunting framework designed for scanning websites for malicious objects. Note-1 : The framework was first presented at the No Hat conference in Bergamo, Italy on October 22nd, 2022 Slides, YouTube...

ThreatHunting-JupyterNotebooks

🟣 Weekly Purple Team - Threat Hunting Notebooks A collection of threat hunting and detection engineering Jupyter notebooks accompanying the Weekly Purple Team YouTube channel. Each notebook provides detection logic to help security professionals understand both offensive techniques and defensive...

AzureHunter

A Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes. Getting Started 1. Check that you have the right O365 Permissions...

strelka

Releases | Documentation | Pull Requests | Issues !Pull...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Sample EVTX files are in the .\evtx directory Note If your antivirus freaks out after...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

ACE

Automated Collection and Enrichment The Automated Collection and Enrichment ACE platform is a suite of tools for threat hunters to collect data from many endpoints in a network and automatically enrich the data. The data is collected by running scripts on each computer without installing any...

soc-analyst-hub

🛡️ SOC Analyst Hub — Tier 1 Toolkit A free, fully offline interactive toolkit for Tier 1 SOC analysts — covering incident response, alert triage, threat hunting, and analyst onboarding. Zero dependencies. Single HTML file. Open in any browser. 🚀 Live Demo → 📦 What's Inside ⚡ Incident Response...

ja4

JA4+™ Network Fingerprinting JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for...