ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW & ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

✭ 32

C#detection etw threat-hunting csharp-code meterpreter defensive blueteam blue-team networkmonitor tcpview etw-monitoring-threads defensivetool tcpv4

SysmonConfigPusher

Pushes Sysmon Configs

✭ 59

C#windows sysmon threat-hunting siem

PowerGRR

PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

✭ 52

powershell incident-response threat-hunting grr powershell-module

MindMaps

#ThreatHunting #DFIR #Malware #Detection Mind Maps

✭ 224

windows detection incident-response forensics dfir threat-hunting mindmap threat-intelligence

Azure-Sentinel-4-SecOps

Microsoft Sentinel SOC Operations

✭ 140

powershell HTML CSS M4 microsoft security azure incident-response secops threat-hunting siem hunting soc ir cloudsecurity threat-intelligence azure-sentinel microsoft-sentinel

censys-recon-ng

recon-ng modules for Censys

✭ 29

python shell osint cybersecurity penetration-testing pentesting threat-hunting threatintel recon-ng threat-intelligence censys-api osinttool osint-reconnaissance recon-ng-modules

SIGMA-detection-rules

Set of SIGMA rules (>250) mapped to MITRE Att@k tactic and techniques

✭ 97

windows threat-hunting sigma mitre-attack

SSHapendoes

Capture passwords of login attempts on non-existent and disabled accounts.

✭ 31

c Makefile canary honeypot sshd threat-hunting threat-intelligence honeypots ssh-rankings custom-pam capture-passwords

ELK-Hunting

Threat Hunting with ELK Workshop (InfoSecWorld 2017)

✭ 58

powershell elasticsearch kibana logstash filebeat elk threat-hunting winlogbeat elastic nsm elk-stack

malware-persistence

Collection of malware persistence and hunting information. Be a persistent persistence hunter!

✭ 109

persistence malware threat-hunting malware-analysis threat-intelligence malware-detection malware-persistence

Malware-Sample-Sources

Malware Sample Sources

✭ 214

virus malware malwareanalysis cybersecurity infosec viruses threat-hunting malware-analysis malware-research virus-scanning malware-samples threat-intelligence malware-sample malware-detection malware-database malware-dataset advanced-persistent-threat

ps-srum-hunting

PowerShell Script to facilitate the processing of SRUM data for on-the-fly forensics and if needed threat hunting

✭ 16

powershell threat-hunting ir srum

ThreatIntelligence

Tracking APT IOCs

✭ 23

threat-hunting threat-sharing threatintel threat-intelligence

csirtg-smrt-v1

the fastest way to consume threat intelligence.

✭ 27

python Makefile Batchfile security threat-hunting threat-sharing threatintel

thremulation-station

Small-scale threat emulation and detection range built on Elastic and Atomic Redteam.

✭ 28

shell powershell ruby security threat-hunting elastic threat-detection atomicredteam

SysmonResources

Consolidation of various resources related to Microsoft Sysmon & sample data/log

✭ 64

python threat sysmon threat-hunting

DomainCAT

Domain Connectivity Analysis Tools to analyze aggregate connectivity patterns across a set of domains during security investigations

✭ 34

python Jupyter Notebook Dockerfile graph analysis jupyter-notebook cybersecurity threat-hunting

TA-Sysmon-deploy

Deploy and maintain Symon through the Splunk Deployment Sever

✭ 31

Batchfile splunk dfir sysmon threat-hunting splunk-deployment

Owlyshield

Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..

✭ 281

rust C++c Inno Setup machine-learning malware cybersecurity ransomware antivirus threat-hunting malware-analysis malware-research behavior-analysis impact exfiltration command-and-control edr

utilities

This repository contains tools used by 401trg.

✭ 19

python tools utilities verizon threat-hunting threat-analysis 401trg protectwise

Judge-Jury-and-Executable

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.

✭ 66

c C#Yacc C++Lex M4 security scanner forensics antivirus threat-hunting query-language yara forensic-analysis yara-rules mft yara-scanner forensics-investigations threat-monitor forensics-level-scanning

mail to misp

Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.

✭ 61

python shell threat-hunting misp threatintel misp-api threat-intelligence

evtx-hunter

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

✭ 122

python CSS incident-response csirt infosec threat-hunting netsec evtx

61-115 of 115 threat-hunting projects

‹