threat-hunting

There are 139 repositories under threat-hunting topic.

MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
misp threat-sharing threat-hunting threatintel malware-analysis stix information-exchange fraud-management security cti cybersecurity fraud-detection fraud-prevention threat-analysis information-security information-sharing threat-intelligence threat-intelligence-platform intelligence threat-intel
Language:PHP 4970
SwiftOnSecurity / sysmon-config
Sysmon configuration file template with default high-quality event tracing
sysmon threatintel threat-hunting sysinternals windows netsec monitoring logging
4564
elceef / dnstwist
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
dns domains fuzzing homoglyph homograph-attack idn osint phishing scanner threat-hunting threat-intelligence typosquatting
Language:Python 4521
OISF / suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
cybersecurity ids intrusion-detection-system intrusion-prevention-system ips network-monitor network-monitoring nsm security suricata threat-hunting
Language:C 4030
OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
dfir hunter hunting hunting-campaigns hypothesis mitre mitre-attack-db sysmon threat-hunting
Language:Python 3860
Cyb3rWard0g / HELK
The Hunting ELK
hunting elasticsearch kibana logstash hunting-platforms elk elk-stack elastic docker jupyter-notebook threat-hunting spark dockerhub
Language:Jupyter Notebook 3692
0x4D31 / awesome-threat-detection
✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️
awesome awesome-list detection incident-response security threat-detection threat-hunting
3327
InQuest / awesome-yara
A curated list of awesome YARA rules, tools, and people.
awesome awesome-list awesome-yara ioc malware-analysis malware-detection malware-research malware-rules threat-hunting yara yara-manager yara-rules yara-scanner yara-signatures
3245
IntelOwl
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
cyber-security cyber-threat-intelligence cybersecurity dfir enrichment hacktoberfest honeynet incident-response intel-owl ioc malware-analysis malware-analyzer osint osint-python python security-tools threat-hunting threat-intelligence threathunting threatintel
Language:Python 3103
teler
kitabisa / teler
Real-time HTTP Intrusion Detection
analyze-logs go golang ids intrusion intrusion-detection intrusion-detection-system iocs log log-analyzer logs threat threat-analyzer threat-hunting threat-intelligence threat-rules
Language:Go 2965
Security-Onion-Solutions / securityonion
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
case-management cyber-security endpoint-security information-security intrusion-detection-system monitoring network-security security security-tools threat-hunting
Language:Shell 2820
alexandreborges / malwoverview
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.
alienvault cybersecurity malpedia malshare malware malware-analysis malwarebazaar threat-hunting threatfox threathunting threatintelligence triage urlhaus virustotal
Language:Python 2701
WithSecureLabs / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
attack rust security threat-hunting blueteam chainsaw detection dfir forensics logs sigma windows countercept
Language:Rust 2541
olafhartong / sysmon-modular
A repository of sysmon configuration modules
sysmon dfir threat-hunting mitre-attack modular security-tools
Language:PowerShell 2485
Neo23x0 / signature-base
YARA signature and IOC database for my scanners and tools
anti-virus dfir hash ioc scanner signature threat-hunting threat-intelligence yara yara-rules
Language:YARA 2325
blackorbird / APT_REPORT
Interesting APT Report Collection And Some Special IOC
apt cybersecurity malware security threat-hunting
Language:Python 2175
sbousseaden / EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
threat-hunting evtx windows-security mitre-attack detection-engineering dataset winlogbeat dfir
Language:HTML 2126
Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
dfir threat hunting windows event logs rust sigma detection attack forensics incident response hayabusa yamato security cybersecurity incident-response security-automation threat-hunting
Language:Rust 1920
yeti-platform / yeti
Your Everyday Threat Intelligence
dfir enrichment infosec intelligence threat-hunting threat-sharing threatintel
Language:Python 1625
nshalabi / SysmonTools
Utilities for Sysmon
logging monitoring netsec sysinternals sysmon threat-hunting threat-intelligence threatintel windows
1445
osintbrazuca / osint-brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
brasil hacking osint threat-hunting threat-intelligence threatintel
1357
matano
matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
aws cloud security big-data serverless apache-iceberg log-analytics log-management threat-hunting rust alerting cloud-native aws-security cloud-security cybersecurity secops security-tools dfir detection-engineering siem
Language:Rust 1353
beagle
yampelo / beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
security digital-forensics incident-response graph dfir forensic-analysis threat-hunting
Language:Python 1259
deepfence / YaraHunter
🔍🔍 Malware scanner for cloud-native, as part of CI/CD and at Runtime 🔍🔍
devsecops devsecops-best-practices devsecops-pipeline ioc malware threat-hunting yara yara-scanner ci-cd hacktoberfest
Language:Go 1229
BLUESPAWN
ION28 / BLUESPAWN
An Active Defense and EDR software to empower Blue Teams
active-defense anti-virus blue-team edr mitre-attack security security-tools threat-hunting windows
Language:C++ 1206
StamusNetworks / SELKS
A Suricata based IDS/IPS/NSM distro
suricata network security monitoring management ids ips linux distribution security-monitoring threat-hunting network-intrusion-detection network-security gui user-interface
Language:Shell 1168
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
apt-attacks forensic-analysis incident-response purpleteam python3 threat-hunting windows-event-logs windows-eventlog
Language:Python 1144
olafhartong / ThreatHunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
splunk mitre-attack threat-hunting dfir
1103
0xrawsec / whids
Open Source EDR for Windows
dfir threat-hunting windows ids sysmon edr
Language:Go 1048
sentinel-attack
netevert / sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
siem threat-hunting azure-sentinel mitre-attack sysmon sysmon-config azure blue-team cybersecurity logging security-tools detection kql workbooks terraform-azure
Language:HCL 1037
Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
azure defender-for-endpoint dfir kql sentinel threat-hunting vulnerability-management zero-day blueteam cybersecurity mde mdi infosec security misp
Language:Python 994
curated-intel / Ukraine-Cyber-Operations
Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Slava Ukraini. Glory to Ukraine.
ukraine osint cti threat-intelligence iocs threat-hunting yara malware
Language:YARA 909
alvin-tosh / Malware-Exhibit
🚀🚀 This is a 🎇🔥 REAL WORLD🔥 🎇 Malware Collection I have Compiled & analysed by researchers🔥 to understand more about Malware threats😈, analysis and mitigation🧐.
apt cryptography cybersecurity encryption-decryption ethical-hacking infosec keylogger malware malware-analysis malware-research notpetya-malware petya ransomware spyware stealer-windows threat-hunting threat-intelligence trojan virus wannacry-ransomware
Language:Assembly 900
osintbrazuca / osint-brazuca-regex
Repositório criado com intuito de reunir expressões regulares dentro do contexto Brasil
brasil brazil hacking osint regex threat-hunting threat-intelligence
890
ninoseki / mihari
A query aggregator for OSINT based threat hunting
threat-hunting threat-intelligence osint
Language:Ruby 818
Watcher
thalesgroup-cert / Watcher
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
certificate-transparency certstream cybersecurity django incident-response misp monitoring nltk osint osint-python phishing reactjs rss-bridge security thehive threat-detection threat-hunting threat-intelligence watcher webapp
Language:Python 793

threat-hunting

MISP / MISP

SwiftOnSecurity / sysmon-config

elceef / dnstwist

OISF / suricata

OTRF / ThreatHunter-Playbook

Cyb3rWard0g / HELK

0x4D31 / awesome-threat-detection

InQuest / awesome-yara

intelowlproject / IntelOwl

kitabisa / teler

Security-Onion-Solutions / securityonion

alexandreborges / malwoverview

WithSecureLabs / chainsaw

olafhartong / sysmon-modular

Neo23x0 / signature-base

blackorbird / APT_REPORT

sbousseaden / EVTX-ATTACK-SAMPLES

Yamato-Security / hayabusa

yeti-platform / yeti

nshalabi / SysmonTools

osintbrazuca / osint-brazuca

matanolabs / matano

yampelo / beagle

deepfence / YaraHunter

ION28 / BLUESPAWN

StamusNetworks / SELKS

ahmedkhlief / APT-Hunter

olafhartong / ThreatHunting

0xrawsec / whids

netevert / sentinel-attack

Bert-JanP / Hunting-Queries-Detection-Rules

curated-intel / Ukraine-Cyber-Operations

alvin-tosh / Malware-Exhibit

osintbrazuca / osint-brazuca-regex

ninoseki / mihari

thalesgroup-cert / Watcher