V1D1AN

assemblyline-service-misp-warninglists. This Assemblyline service runs in the REVIEW stage and checks submission tag values against PyMISPWarningLists.

sigmacatch. Capture real Windows events and match them against Sigma rules to produce regression data

misp-warninglist-to-assemblyline. Python

connector-rosti. Connector Rosti for OpenCTI

connector-vigilintel. Connecteur VigilIntel for OpenCTI

connector-assemblyline-import. Connector OpenCTI/AssemblyLine for Import

connector-euvd. Connecteur EUVD for OpenCTI

VigilIntel. Dans le cadre de l’amélioration continue des capacités de veille cyber, ce projet vise à fournir une synthèse quotidienne des menaces émergentes à partir de sources ouvertes fiables, notamment via l’agrégation de flux RSS spécialisés.

connector-assemblyline. Connecteur AssemblyLine for OpenCTI

CVE2CAPEC. Generate MITRE ATT&CK and D3FEND from a list of CVEs. Database with CVE, CWE, CAPEC, MITRE ATT&CK D3FEND and ATLAS Techniques data is updated daily. Showcased at BlackHat Europe 2025 Arsenal.

EDR-Telemetry. This project aims to compare and evaluate the telemetry of various EDR products.

colander. Case, knowledge management and digital investigation platform

osquery-packs-and-dashboards.

cvelistV5. CVE cache of the official CVE List in CVE JSON 5 format

basicgopot. Honeypot for file uploads. Written in Go.

velocistack. JavaScript

aria2-onion-downloader. Download from .onion-domains faster.

assemblyline-service-triage-sandbox. Python

crawley. The unix-way web crawler

ZVELK. Shell

TeamsPhisher. Send phishing messages and attachments to Microsoft Teams users

SilkETW. C#

gpt4all. GPT4All: Run Local LLMs on Any Device. Open-source and available for commercial use.

connectors. OpenCTI Connectors

assemblyline. AssemblyLine 4: File triage and malware analysis

secubian-wiki.

secubian. SECUBIAN is a French Linux distribution focused on evidence processing during Incident Response.

Wazuh-Rules. Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!

velociraptor. Digging Deeper....

Cortex-Analyzers. Cortex Analyzers Repository

dagda. a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities

stoq. An open source framework for enterprise level automated analysis.

simplewall. Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.

CVE-2021-21974. POC for CVE-2021-21974 VMWare ESXi RCE Exploit

catalyst. ⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes

malware-exquacker-modules. Python

karton. Distributed malware processing framework based on Python, Redis and S3.

aurora. Malware similarity platform with modularity in mind.

littlenavmap. Little Navmap is a free flight planner, navigation tool, moving map, airport search and airport information system for Flight Simulator X, Microsoft Flight Simulator 2020, Prepar3D and X-Plane.

DFIRMindMaps. A repository of DFIR-related Mind Maps geared towards the visual learners!

mercator. Mapping the information system / Cartographie du système d'information

honeymail. SMTP honeypot written in Golang

Zircolite-Rules. Sigma rules converted for direct use with Zircolite

IRM.

EVTX-ETW-Resources. Event Tracing For Windows (ETW) Resources

Microsoft-eventlog-mindmap. Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

detection-rules. Python

EnableWindowsLogSettings. Documentation and scripts to properly enable Windows event logs.

RedEye. RedEye is a visual analytic tool supporting Red & Blue Team operations

changedetection.io. Best and simplest tool for website change detection, web page monitoring, and website change alerts. Perfect for tracking content changes, price drops, restock alerts, and website defacement monitoring—all for free or enjoy our SaaS plan!

elsec_dr2an. Script to create MITRE ATT&CK Navigator layers from the annotated detection rules in Elastic Security (Kibana).

IOCmite. Create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert

sliver. Adversary Emulation Framework

ail-framework. AIL framework - Analysis Information Leak framework

PoC-CVE-2022-30190. POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina

freki. :wolf: Malware analysis platform

YAFRA. YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.

multiscanner. Modular file scanning/analysis framework

static_file_analysis. Analysis of file (doc, pdf, exe, ...) in deep (emmbedded file(s)) with clamscan and yara rules

CVE-2022-1388. POC for CVE-2022-1388

sigmai. Import specific data sources into the Sigma generic and open signature format.

deepdarkCTI. Collection of Cyber Threat Intelligence sources from the deep and dark web

Watcher. Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

stoq-plugins-public. stoQ Public Plugins

malware-traffic. Download all packet captures from http://malware-traffic-analysis.net/

malware-traffic. Download all packet captures from http://malware-traffic-analysis.net/

dsiem. Security event correlation engine for ELK stack

S1EM. This project is a SIEM with SIRP and Threat Intel, all in one.

praeco. Elasticsearch alerting made simple.

bento. The minimalist, elegant and hackable startpage.

dfir-iris-misp-timesketch. Scripts to integrate DFIR-IRIS, MISP and TimeSketch

awesome-honeypots. an awesome list of honeypot resources

karton-config-extractor. Static configuration extractor for the Karton framework

DFIR-Laptop. Installation of all the tools for a stand-alone DFIR laptop

DFIRArtifactMuseum. The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts that may no longer be readily available anymore.

ChooseYourSIEMAdventure. Python

sigma-cli. The Sigma command line interface based on pySigma

Shuffle. Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

Winshark. A wireshark plugin to instrument ETW

ThePhish. ThePhish: an automated phishing email analysis tool

GreedyBear. Threat Intel Platform for T-POTs

DFIR_Linux_Collector. The Linux DFIR Collector is a stand-alone collection tool for Gnu / Linux. Dump artifacts in json format with very few impacts on the host system. Created for incident response Team.

Malcolm. Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

iris-web. Collaborative Incident Response platform

SOC-OpenSource. This is a Project Designed for Security Analysts and all SOC audiences who wants to play with implementation and explore the Modern SOC architecture.

opencti. Open Cyber Threat Intelligence Platform

yarGen. yarGen is a generator for YARA rules

Grafiki. Threat Hunting tool about Sysmon and graphs

Yara-Repo. A script to collect (the most famous) Yara rules from more than 150 free resources. Free alternative to: https://valhalla.nextron-systems.com/

DailyIOC. IOC from articles, tweets for archives

EVTX-to-MITRE-Attack. Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

evtx-nom. Offline/File based EVTX Ingest for Elasticsearch (ECS) and more, no Windows required

lufi-docker. Docker Image for Lufi, it means Let's Upload that FIle. It's a E2E encrypted file sharing software.

PcapMonkey. PcapMonkey will provide an easy way to analyze pcap using the latest version of Suricata and Zeek.

clamav-unofficial-sigs. ClamAV Unofficial Signatures Updater maintained by eXtremeSHOK.com

sysmon-auto-install. Install and auto update scripts for sysmon and winlogbeat

APTSimulator. A toolset to make a system look as if it was the victim of an APT attack

tpotce. 🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

Lab-DFIR-SOC. Shell

mwdb-core. Malware repository component for samples & static configuration with REST API interface.

sigma. Main Sigma Rule Repository

DFIRLab. DFIRLab / Plateforme d'investigation numérique

Zircolite. A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

MISP2memcached. Load MISP events into memcached for log enrichment using logstash

S1EM. This project is a SIEM with SIRP and Threat Intel, all in one.