threat-hunting

Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

An Active Defense and EDR software to empower Blue Teams

🔍🔍 Malware scanner for cloud-native, as part of CI/CD and at Runtime 🔍🔍

A curated list of annual cyber security reports

🚀🚀 This is a 🎇🔥 REAL WORLD🔥 🎇 Malware Collection I have Compiled & analysed by researchers🔥 to understand more about Malware threats😈, analysis and mitigation🧐.

Threat-hunting tool for Linux

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

Repositório criado com intuito de reunir expressões regulares dentro do contexto Brasil

openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

A query aggregator for OSINT based threat hunting

Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.

Extract and aggregate threat intelligence.

A collection of resources for Threat Hunters

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

Automatically created C2 Feeds

SIEM Tactics, Techiques, and Procedures

Kaspersky's GReAT KLara

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.

Scirius is a web application for Suricata ruleset management and threat hunting.

Awesome list of keywords and artifacts for Threat Hunting sessions

常见的攻击行为监测特征及方法，涵盖端点和流量，未包含PowerShell和Sysmon。预祝运营生活愉快！

This repo is about Active Directory Advanced Threat Hunting

Production-ready detection & response queries for osquery

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Clusters and elements to attach to MISP events or attributes (like threat actors)

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform