#threat-hunting (30 Repositories)

Security-Onion-Solutions/securityonion

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

Vigil-SOC/vigil

Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

MISP/MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

THORCollective/HEARTH

A community-driven repository for threat hunting ideas, methodologies, and research that serves as a central gathering place for hunters to share knowledge, collaborate on techniques, and advance the field of threat hunting.

MISP/misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

OISF/suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

elastic/detection-rules

fhightower/ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

WithSecureOpenSource/chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

helixmap/sigwood

Local-first, transparent threat hunting for the logs you already have: Zeek, Pi-hole, syslog, CloudTrail. Named technique behind every finding. No SIEM, no agent, no black box.

boringtools/git-alerts

Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files

chainguard-dev/osquery-defense-kit

Production-ready detection & response queries for osquery

Bert-JanP/Open-Source-Threat-Intel-Feeds

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

thalesgroup-cert/Watcher

Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

pandaadir05/ghost

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

osintbrazuca/osint-brazuca

Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.

kunai-project/kunai

Threat-hunting tool for Linux

atenreiro/opensquat

openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.

A3sal0n/CyberThreatHunting

A collection of resources for Threat Hunters

tomwechsler/Active_Directory_Advanced_Threat_Hunting

This repo is about Active Directory Advanced Threat Hunting

dev-lu/osint_toolkit

Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.

0x4D31/awesome-threat-detection

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

Bert-JanP/Hunting-Queries-Detection-Rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

utkusen/baitroute

A web honeypot library to create vulnerable-looking endpoints to detect and mislead attackers

jepayneMSFT/WEFFLES

Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI

decal/werdlists

:keyboard: Wordlists, Dictionaries and Other Data Sets for Writing Software Security Test Cases

ridgelinecyberdefence/vanguard

Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.

darkquasar/AzureHunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

SitinCloud/Owlyshield

Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).

LearningKijo/SecurityResearcher-Note

Cover various security approaches to attack techniques and also provides new discoveries about security breaches.