mthcht

awesome-lists. Awesome Security lists for SOC/CERT/CTI

ThreatHunting-Keywords. Awesome list of keywords and artifacts for Threat Hunting sessions

Purpleteam. Purpleteam scripts simulation & Detection - trigger events for SOC detections

ThreatIntel-Reports. Raw data from Threat Intelligence Reports with automatic reports collection and keyword search across thousands of reports

ThreatHunting-Keywords-yara-rules. yara detection rules for hunting with the threathunting-keywords project

ThreatHunting-Keywords-sigma-rules. Sigma detection rules for hunting with the threathunting-keywords project

lookup-editor_scripts. scripts using splunk application lookup-editor endpoint. Download, upload and update splunk lookups content

mthcht.

OpenProject. A practical resource on using open-source tools for Incident Response. This repo shares workflows, tool setups, and steps for responding quickly to security incidents.

deepdarkCTI. Collection of Cyber Threat Intelligence sources from the deep and dark web

iocs. Indicators from Unit 42 Public Reports

Splunk4DFIR. harness the power of Splunk for your investigations

ransomware_notes. An Archive of Ransomware Notes Past and Present Collected by Zscaler ThreatLabz

Splunk-Search-Recipes. A curated collection of Splunk searches across multiple categories, designed to assist in data analysis, monitoring, and troubleshooting

Ultimate-RAT-Collection. For educational purposes only, exhaustive samples of 450+ classic/modern trojan builders including screenshots.

Hunting-Queries-Detection-Rules. KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

awesome-yara. A curated list of awesome YARA rules, tools, and people.

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Ransomware-Tool-Matrix. A resource containing all the tools each ransomware gangs uses

awesome-tunneling. List of ngrok/Cloudflare Tunnel alternatives and other tunneling software and services. Focus on self-hosting.

dns-blocklists. DNS-Blocklists: For a better internet - keep the internet clean!

security_content. Splunk Security Content

dnstwist. Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

MAL-CL. MAL-CL (Malicious Command-Line)

uac. UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Detection-Validation. Detection rule validation

ClatScope. ClatScope Info Tool – The best and most versatile OSINT utility for retrieving geolocation, DNS, WHOIS, phone, email, data breach information and much more (70+ features). Perfect for investigators, pentesters, or anyone looking for an effective reconnaissance / OSINT tool.

maltrail. Malicious traffic detection system

Remote-administration-tools-archive. Here are +200 different rats some with source code

cti. Cyber Threat Intelligence Repository expressed in STIX 2.0

EDR-Telemetry. This project aims to compare and evaluate the telemetry of various EDR products.

EventLogs-Samples. Raw events logs from simulated or real attacks

AutonomousThreatSweeper. Threat Hunting queries for various attacks

ADTimeline. Timeline of Active Directory changes with replication metadata

RdpCacheStitcher. RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

rpcfirewall. C++

ThreatHunter-Playbook. A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

Open-Source-Threat-Intel-Feeds. This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

dyn-dns-list. This repository contains a comprehensive list of over 30k dynamic DNS domains as of 2024. The list is provided for informational purposes only and can be used for a variety of purposes, including blocking malicious domains, filtering content, and enhancing privacy and security.

lolcerts. A repository of code signing certificates known to have been leaked or stolen, then abused by threat actors

PSBits. Simple (relatively) things allowing you to dig a bit deeper than usual.

Malware-Knowledge-Graph. Create malware knowledge graphs from analysis reports

fapro. Fake Protocol Server

laurel. Transform Linux Audit logs for SIEM usage

dfir-orc. Forensics artefact collection tool for systems running Microsoft Windows

ACCD. Active C&C Detector

chainsaw. Rapidly Search and Hunt through Windows Forensic Artefacts

DefenderYara. Extracted Yara rules from Windows Defender mpavbase and mpasbase

C2-Tracker. Live Feed of C2 servers, tools, and botnets

KapeFiles2DFIR-orc-config. Convert Kape Files to DFIR-ORC configurations

LOLRMM. LotL RMM

jarm. Python

ThreatIntelligenceCorpus.

MITRE-Mappings. A public repository of MITRE ATT&ACK TTP mappings by BushidoUK for OSINT reports that lack a section breaking down the TTPs.

WELA. WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

InsightEngineering.

bmc-tools. RDP Bitmap Cache parser