threathunting

There are 11 repositories under threathunting topic.

IntelOwl
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
cyber-security cyber-threat-intelligence cybersecurity dfir enrichment hacktoberfest honeynet incident-response intel-owl ioc malware-analysis malware-analyzer osint osint-python python security-tools threat-hunting threat-intelligence threathunting threatintel
Language:Python 4313
alexandreborges / malwoverview
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest, VxExchange and IPInfo, and it is also able to scan Android devices against VT.
malware virustotal malpedia urlhaus alienvault malshare threathunting malwarebazaar threatfox cybersecurity malware-analysis threat-hunting threatintelligence triage
Language:Python 3409
mandiant / ThreatPursuit-VM
Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.
cyber threat threatintelligence threathunting intelligence intelligence-analysis data-science analytics malware virtual-machine mandiant fireeye
Language:PowerShell 1285
atomic-threat-coverage
atc-project / atomic-threat-coverage
Actionable analytics designed to combat threats
incidentresponse mitre-attack threat-model threatdetection threathunting threatintelligence
Language:Python 999
AzureHunter
darkquasar / AzureHunter
A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
azforensics azure azure-forensics azuresearcher cloud-forensics cybersecurity dfir digital-forensics incident-response powershellv5 threat-hunting threathunting unifiedauditlog
Language:PowerShell 787
SlimKQL / Hunting-Queries-Detection-Rules
KQL Queries. Microsoft Defender, Microsoft Sentinel
azure defenderxdr kql sentinel threatdetection defender microsoft mitre-attack threathunting
Language:JavaScript 743
tenzir
tenzir / tenzir
Tenzir is the data pipeline engine for security teams.
incident-response threathunting siem soc security dataops investigation pcap secdataops netflow suricata zeek pipelines sigma hacktoberfest
Language:C++ 703
ThreatHunting-Keywords
mthcht / ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
awesome-list blueteam detection-engineering dfir elk-stack endpoint-security forensic hacktools incident-response iocs offensive-scripts offensive-security redteam siem soc splunk threat-hunting threat-intelligence threathunting yara-rules
Language:PowerShell 604
MDATP
alexverboon / MDATP
MDATP
blogs defender-for-endpoint defender-for-identity kql learning microsoft-defender-xdr threathunting defender-for-cloud-apps defender-for-office-365
Language:PowerShell 460
GACWR / OpenUBA
A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [PRE-ALPHA]
ueba datascience cybersecurity analytics threathunting tensorflow spark flask information-security siem anomaly-detection uba sklearn security elk elasticsearch machine-learning nodejs user-behaviour react
Language:Python 449
Kirtar22 / Litmus_Test
Detecting ATT&CK techniques & tactics for Linux
blue-team defensive-security incident-response linux-hunting mitre-attack red-team security-operations threathunting
Language:Roff 258
AbdulRhmanAlfaifi / Fennec
Artifact collection tool for *nix systems
dfir rust ir threathunting blueteam
Language:Rust 210
Purpleteam
mthcht / Purpleteam
Purpleteam scripts simulation & Detection - trigger events for SOC detections
blueteam detection linux mitre-attack offensive-scripts purpleteam redteam security siem simulation soc tactics techniques windows awesome awesome-list ioc threat-hunting threathunting detection-engineering
Language:PowerShell 190
UncoderIO / Uncoder_IO
An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.
datalake edr roota siem sigma threathunting translation uncoder uncoderio xdr
Language:Python 158
Viralmaniar / MurMurHash
This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.
redteam blueteam phishing phishing-detection cybersecurity infosec security-tools redteaming threathunting threat-intelligence threatintel threatintelligence proactive-security murmurhash murmurhash3 blueteaming purpleteam
Language:Python 117
alt3kx / wafaray
Enhance your malware detection with WAF + YARA (WAFARAY)
blueteam blueteaming pentesting security-tools threat-intelligence threathunting waf yara yara-rules
Language:Shell 109
Truvis / SplunkDashboards
Collection of Dashboards for Threat Hunting and more!
splunk splunk-application splunk-enterprise splunk-addon splunk-http splunk-impact-cloud splunk-alerts dashboard dashboards dashboard-templates dashboard-application dashboard-widget threat-intelligence threathunting threat-hunting threatintel audit auditing audit-logs suricata
69
csirtgadgets / cif-v5
The FASTEST way to consume threat intel.
cif csirtg threathunting threatintel
Language:Python 68
ThreatHunting-Keywords-sigma-rules
mthcht / ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
blueteam detection-engineering detection-rules siem sigma-rules threat-detection threat-hunting threathunting dfir forensicartifacts mitre-attack
Language:Python 56
0xAnalyst / Sysmon
Sysmon config for both Windows and Linux Devices. Windows one is a bit dated
sysmon-config threathunting
Language:Batchfile 55
svch0stz / TheThreatHuntLibrary
Library of threat hunts to get any user started!
hunting mitre hypothesis threat-hunting threathunting cybersecurity
Language:Python 45
HackLab
victorpreston / HackLab
Welcome to HackLab, your go-to resource for hands-on cybersecurity projects. This repository is a collection of step-by-step projects designed to enhance your understanding of various cybersecurity concepts, techniques, and tools.
cyber-security cybersecurity hack hacking hacking-tools keylogger network network-security offensive-scripts password python python-hacking python3 threathunting wifi
Language:Python 37
HellishPn / Volatility-MM-CS
Volatility MindMap & Cheat Sheet
volatility forensics bluteam threathunting incident-response-tooling mindmap cheatsheet
29
eremit4 / Akamaru
Sniffing out well-known threat groups
apt-groups cti python ransomware-resources threat-hunting threat-intelligence hunting mitre-attack sentinelone threathunting threatintel mitre-attack-db ransomlook
Language:Python 28
stvetro / HuntWithChatGPT
Tiny proof-of-concept PowerShell script to do threat hunting using ChatGPT (text-davinci-003)
chatgpt dfir forensics ir powershell threathunting
Language:PowerShell 28
ecstatic-nobel / Aisle25
Detect leaks in security event logs.
cyber data-leak dfir entropy infosec password-dump protected-event-logging python splunk threathunting windows-security
Language:Python 20
TheCyberArcher / SOC-Ressources
Repository for SOC analysts, queries to investigate, advanced hunting, sites for analysis, malware samples, courses to improve skills, IOC and monitoring.
cybersecurity cyberdefense edr siem soc threathunting socanalyst
17
00gxd14g / misp-extractor
This is a simple Python script that connects to a MISP instance and retrieves attributes of specific types (such as IP addresses, URLs, and hashes). The retrieved attributes are then written to separate files.
blueteam cyberintelligence cybersecurity intelligence misp threathunting
Language:Python 16
elceef / yara-rulz
Collection of generic YARA rules
threathunting yara
Language:YARA 16
BenjiTrapp / aws-threat-hunting
Short deep dive into Threat Hunting on AWS
aws cloudtrail detection-engineering jupyter-notebook threathunting
Language:Jupyter Notebook 13
ManuelBerrueta / BST
🏴‍☠️ BST is an ever-evolving collection of 🛠 tools to help in security and administration tasks 😉
security offensivesecurity offensive-security azure dfir incident-response redteam redteam-tools redteaming threat-hunting threathunting applicationsecurity appsec containers kubernetes blueteam cloud
Language:Python 11
TeMiroYteHasheo / The-Hunters-Framework
Project to Support The Hunter's Framework (THF)
threathunting threat-hunting threat-detection thf cybersecurity cybersecurity-education
11
N3tworkSec / N3tstatIDS
Lightweight Endpoint Detection & Response (EDR) Framework
n3tstat-ids edr beacon-analysis threathunting apt beacon-hunting apt-detection malware detection
9
Richard1611 / RemoteKapeTriage
A powershell tool that automate the remote forensic evidence adquisitions (triage) from Remote windows machines, using KAPE tool.
powershell powershell-script forensics incident-response forensic-analysis threathunting kape triage cybersecurity information-security information-gathering
Language:PowerShell 8
buzzer-re / DeepSecurity-2-ATTCK
Pull your DS rules and build a ATT&CK matrix
mitre-attack threathunting blueteam deep-security
Language:Python 7
xFFninja / happy_threat_hunting
Threat Hunting
detection kql siem sigma-rules threathunting
6

threathunting

intelowlproject / IntelOwl

alexandreborges / malwoverview

mandiant / ThreatPursuit-VM

atc-project / atomic-threat-coverage

darkquasar / AzureHunter

SlimKQL / Hunting-Queries-Detection-Rules

tenzir / tenzir

mthcht / ThreatHunting-Keywords

alexverboon / MDATP

GACWR / OpenUBA

Kirtar22 / Litmus_Test

AbdulRhmanAlfaifi / Fennec

mthcht / Purpleteam

UncoderIO / Uncoder_IO

Viralmaniar / MurMurHash

alt3kx / wafaray

Truvis / SplunkDashboards

csirtgadgets / cif-v5

mthcht / ThreatHunting-Keywords-sigma-rules

0xAnalyst / Sysmon

svch0stz / TheThreatHuntLibrary

victorpreston / HackLab

HellishPn / Volatility-MM-CS

eremit4 / Akamaru

stvetro / HuntWithChatGPT

ecstatic-nobel / Aisle25

TheCyberArcher / SOC-Ressources

00gxd14g / misp-extractor

elceef / yara-rulz

BenjiTrapp / aws-threat-hunting

ManuelBerrueta / BST

TeMiroYteHasheo / The-Hunters-Framework

N3tworkSec / N3tstatIDS

Richard1611 / RemoteKapeTriage

buzzer-re / DeepSecurity-2-ATTCK

xFFninja / happy_threat_hunting