Threat Hunting queries of multiple platforms
☆85Sep 24, 2026Updated 3 weeks ago
Alternatives and similar repositories for Threat-Hunting
Users that are interested in Threat-Hunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A public repository of quality research on cyber attack techniques. This is the backend for the Technique Research Report (TRR) Library.☆33Sep 1, 2026Updated last month
- A collection of CQL hunting leads for CrowdStrike Falcon and LogScale, mapped to the MITRE ATT&CK framework.☆35Sep 8, 2026Updated last month
- An Obsidian-Based Second Brain for CyberSecurity Analysts and Professionals☆62Feb 18, 2026Updated 7 months ago
- Visualize Microsoft Defender XDR process trees and security events☆33Aug 24, 2025Updated last year
- CQL Hub is an open repository of detection and hunting queries for CrowdStrike NextGen SIEM and Falcon LogScale. All queries stored here …☆86Sep 29, 2026Updated 2 weeks ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- This repository contains various threat hunting tools written in Python and is documented in the series Python Threat Hunting Tools which…☆22Nov 16, 2023Updated 2 years ago
- A VS Code plugin to execute arbitrary JavaScript code at runtime over a local HTTP endpoint.☆33Feb 10, 2026Updated 8 months ago
- DetectPack Forge turns plain-English behaviors or sample logs into production-ready detection packs — Sigma, KQL (Sentinel), SPL (Splunk)…☆24Mar 19, 2026Updated 6 months ago
- Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensic…☆158Jul 28, 2026Updated 2 months ago
- Desktop KQL query builder for Microsoft security and Azure services - 52 tables across Defender, Sentinel, Entra ID, Azure Monitor, App I…☆47Jun 22, 2026Updated 3 months ago
- Automated security investigation tool using Microsoft MCP Servers, GitHub Copilot, Python Modules and custom copilot-instructions.☆249Oct 8, 2026Updated last week
- DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them agai…☆35Jul 28, 2026Updated 2 months ago
- ☆30Oct 13, 2025Updated last year
- Windows EVTX log analysis for DFIR — fast parsing, ATT&CK mapping, IOC extraction, and Sentinel anomaly detection. Normal + Juggernaut Mo…☆58Sep 6, 2026Updated last month
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- A collection of Claude Code skills that help security teams stay secure☆58Apr 27, 2026Updated 5 months ago
- Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques☆131Dec 28, 2025Updated 9 months ago
- Track C2 servers, tools, and botnets over time by framework and location☆16Aug 17, 2025Updated last year
- Automatic, fast parsing of browser artifacts☆17Jan 4, 2025Updated last year
- Awesome Security lists for SOC/CERT/CTI☆1,945Updated this week
- This repository contains Community and Field contributed content for LogScale☆354Sep 15, 2026Updated last month
- Cyber Threat Intelligence☆83Dec 7, 2025Updated 10 months ago
- FireEye iSIGHT Alert Feeder for TheHive, an Open Source and Free Security Incident Response Platform☆16Oct 12, 2018Updated 8 years ago
- Indicators of Normality☆11Jul 22, 2022Updated 4 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Persist like a Dodder☆69May 19, 2025Updated last year
- A multi-mode terminal AI agent supporting GPT-5/Ollama for vision, image creation and edition, video generation,web search, code generati…☆18May 27, 2026Updated 4 months ago
- Advanced Threat Hunting: Ransomware Group☆29Jul 9, 2025Updated last year
- Web-based IOC management platform with threat intelligence enrichment for SOC teams☆22Jun 20, 2026Updated 3 months ago
- This Python script analyzes a Wireshark pcap file and generates a detailed PDF report. The analysis includes protocol statistics, IP addr…☆10Sep 11, 2024Updated 2 years ago
- This project provides a set of Google Apps Scripts designed to help you identify and analyze potentially malicious domains directly from …☆14Sep 4, 2024Updated 2 years ago
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆151Sep 21, 2024Updated 2 years ago
- ☆22Jul 13, 2026Updated 3 months ago
- Framework for Monitoring File Ingestion Source for Yara Matches☆52Mar 10, 2025Updated last year
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- Helping defenders learn and validate npm supply-chain detections with safe atomic tests.☆34Oct 30, 2025Updated 11 months ago
- A threat hunting process☆140Oct 2, 2026Updated 2 weeks ago
- KustoHawk is a lightweight incident triage and response tool designed for effective incident response in Microsoft Defender XDR and Micro…☆159Apr 1, 2026Updated 6 months ago
- Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.☆64Sep 11, 2026Updated last month
- PowerShell tool for streamlined Microsoft Defender Advanced Hunting query management with GitHub Copilot integration☆21Aug 31, 2026Updated last month
- An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.☆348Dec 3, 2025Updated 10 months ago
- Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code an…☆65Oct 8, 2026Updated last week