Threat Hunting

Modular Threat Hunting Tool & Framework

A high-interaction honeypot solution for detecting and analyzing SMB-based attacks

A free and open-source OSINT framework for gathering and analyzing data from various sources

A collection of tools and resources for threat hunters.

A repository to aid Windows threat hunters in looking for common artifacts.

A threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel

Intezer is a cloud-based malware analysis platform that detects and classifies malware using genetic code analysis.

A runtime threat management and attack path enumeration tool for cloud-native environments

A comprehensive Threat Intelligence Program Management Solution for managing the entire CTI lifecycle.

A honeypot designed to detect and analyze malicious activities in instant messaging platforms.

A comprehensive incident response and threat hunting tool for Google Cloud Platform, providing logs and forensic data for effective incident response and threat hunting.

A community-driven repository of pre-built security analytics queries and rules for monitoring and detecting threats in Google Cloud environments across various log sources and activity types.

A Splunk app mapped to MITRE ATT&CK to guide threat hunts.

Threat intelligence and digital risk protection platform

PyIOCe is a Python-based OpenIOC editor that enables security professionals to create, edit, and manage Indicators of Compromise for threat intelligence and incident response operations.

HoneyDB is a honeypot-based threat intelligence platform that provides real-time insights into attacker behavior and malicious activity on networks.

A program to extract IOCs from text files using regular expressions

A web-based visualization tool for navigating and annotating MITRE ATT&CK matrices to support threat analysis, defensive planning, and security coverage assessment.

A collection of YARA rules for research and hunting purposes.

Tool for visualizing correspondences between YARA ruleset and samples

A Linux distribution designed for threat emulation and threat hunting, integrating attacker and defender tools for identifying threats in your environment.

A PowerShell module for threat hunting and security analysis through Windows Event Log processing and malicious activity detection.

A community-driven informational repository providing resources and guidance for hunting adversaries in IT environments.

FireEye Mandiant SunBurst Countermeasures: freely available rules for detecting malicious files and activity