MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Sysmon configuration file template with default high-quality event tracing

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

The Hunting ELK

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

A curated list of awesome YARA rules, tools, and people.

IntelOwl: manage your Threat Intelligence at scale

Real-time HTTP Intrusion Detection

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.

Rapidly Search and Hunt through Windows Forensic Artefacts

A repository of sysmon configuration modules

YARA signature and IOC database for my scanners and tools

Interesting APT Report Collection And Some Special IOC

Windows Events Attack Samples

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Your Everyday Threat Intelligence

Utilities for Sysmon