Threat hunting repo for my independent study on threat hunting with OSQuery
☆27Jan 16, 2018Updated 8 years ago
Alternatives and similar repositories for ThreatWaffle
Users that are interested in ThreatWaffle are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Linux and Windows Hardening Points☆12Mar 6, 2018Updated 8 years ago
- Recon Hunt Queries☆78May 16, 2021Updated 5 years ago
- ☆15Aug 20, 2019Updated 7 years ago
- Creates an ATT&CK Navigator map of an Adversary Emulation Plan☆17Sep 4, 2021Updated 5 years ago
- Collaborative, web-based case management for incident response☆26Jan 23, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.☆57Mar 18, 2022Updated 4 years ago
- A specialized environment for crafting, validating, and testing LimaCharlie detection rules☆15Updated this week
- Lists of sources and utilities utilized to hunt, detect and prevent evildoers.☆172Dec 10, 2018Updated 7 years ago
- Cuckoo sandbox ansible role☆16Apr 30, 2023Updated 3 years ago
- ☆19Aug 2, 2020Updated 6 years ago
- Analyst tool for creating pivot maps of data sources☆16Sep 11, 2017Updated 9 years ago
- ☆18May 23, 2024Updated 2 years ago
- Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.☆45Aug 17, 2020Updated 6 years ago
- Passivedns monitor implementation in Rust.☆12Apr 21, 2016Updated 10 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- brostash: Linux distribution based on Debian and focusing on network security events collection☆33Aug 30, 2020Updated 6 years ago
- Windows version of honeybits - a PoC tool to create breadcrumbs and honeytokens, to lead the attackers to your honeypots!☆24Jun 19, 2017Updated 9 years ago
- Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI☆202Dec 11, 2017Updated 8 years ago
- This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant ya…☆120Apr 14, 2021Updated 5 years ago
- Understanding ATT&CK Matrix for Enterprise☆79May 16, 2018Updated 8 years ago
- Workflows for Shuffle☆25Oct 26, 2022Updated 4 years ago
- Sniffs sensitive data from interface or pcap☆14Feb 19, 2018Updated 8 years ago
- Parses KAPE module files and downloads binaries referenced by BinaryURL☆18Oct 2, 2019Updated 7 years ago
- This package allows the use of a custom Elastalert Alert which creates alerts with observables in TheHive using TheHive4Py.☆26May 18, 2021Updated 5 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- A collection of infosec related scripts and information.☆54Oct 2, 2024Updated 2 years ago
- Osquery Packs we use for customer security hardening☆12Jun 30, 2025Updated last year
- A shell script to download malware domains from various sources, and configuring unbound DNS config file to be used as a local recursive …☆19Sep 12, 2014Updated 12 years ago
- FRAC and RIFT☆17Mar 16, 2019Updated 7 years ago
- Bro analyzer that detects Google's QUIC protocol☆12Mar 2, 2021Updated 5 years ago
- A repository for using osquery for incident detection and response☆909Oct 2, 2026Updated last month
- VelociraptorMCP is a Model Context Protocol bridge for exposing LLMs to MCP clients.☆96Jun 28, 2026Updated 4 months ago
- Security Logon Event Analysis Tools - a collection of scripts for collecting, parsing, and analyzing logon events from Windows Security L…☆16Jun 22, 2016Updated 10 years ago
- Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.☆946Dec 12, 2023Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- .net tool that uses WMI queries to enumerate active sessions and accounts configured to run services on remote systems☆36Dec 9, 2019Updated 6 years ago
- A threat hunting / data analysis environment based on Python, Pandas, PySpark and Jupyter Notebook.☆251Jul 19, 2021Updated 5 years ago
- ☆170Jan 20, 2021Updated 5 years ago
- Windows Event Forwarding subscriptions, configuration files and scripts that assist with implementing ACSC's protect publication, Technic…☆231Feb 5, 2025Updated last year
- A Fast, Modular, and Scalable TLS/SSL Security Scanner Written in Rust☆39Updated this week
- Expert Investigation Guides☆51Mar 18, 2021Updated 5 years ago
- pySigma Cookiecutter backend template☆25Oct 28, 2026Updated last week