Threat Hunting

A repository to aid Windows threat hunters in looking for common artifacts.

A threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel

Intezer is a cloud-based malware analysis platform that detects and classifies malware using genetic code analysis.

A runtime threat management and attack path enumeration tool for cloud-native environments

A comprehensive Threat Intelligence Program Management Solution for managing the entire CTI lifecycle.

A honeypot designed to detect and analyze malicious activities in instant messaging platforms.

A comprehensive incident response and threat hunting tool for Google Cloud Platform, providing logs and forensic data for effective incident response and threat hunting.

A community-driven repository of pre-built security analytics queries and rules for monitoring and detecting threats in Google Cloud environments across various log sources and activity types.

A Splunk app mapped to MITRE ATT&CK to guide threat hunts.

Threat intelligence and digital risk protection platform

PyIOCe is a Python-based OpenIOC editor that enables security professionals to create, edit, and manage Indicators of Compromise for threat intelligence and incident response operations.

HoneyDB is a honeypot-based threat intelligence platform that provides real-time insights into attacker behavior and malicious activity on networks.

A program to extract IOCs from text files using regular expressions

A web-based visualization tool for navigating and annotating MITRE ATT&CK matrices to support threat analysis, defensive planning, and security coverage assessment.

A collection of YARA rules for research and hunting purposes.

Tool for visualizing correspondences between YARA ruleset and samples

A Linux distribution designed for threat emulation and threat hunting, integrating attacker and defender tools for identifying threats in your environment.

A PowerShell module for threat hunting and security analysis through Windows Event Log processing and malicious activity detection.

A community-driven informational repository providing resources and guidance for hunting adversaries in IT environments.

FireEye Mandiant SunBurst Countermeasures: freely available rules for detecting malicious files and activity

Threat hunting tool leveraging Windows events for identifying outliers and suspicious behavior.

Comprehensive endpoint protection platform providing unified visibility and security for cloud workloads, endpoints, and containers.

Lists of sources and utilities to hunt, detect, and prevent evildoers.

A digital forensics tool that extracts and analyzes Windows AppCompat and AmCache registry data for enterprise-scale forensic investigations.