This repository contains various threat hunting tools written in Python and is documented in the series Python Threat Hunting Tools which can be found at Kraven Security - Python Threat Hunting Tools. Feel free to use, expand, and adapt these tools as you learn how to create your own tools to hunt for threats!
☆22Nov 16, 2023Updated 2 years ago
Alternatives and similar repositories for python-threat-hunting-tools
Users that are interested in python-threat-hunting-tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A project designed to make the operationalization of open-source cyber threat intelligence more efficient.☆22Updated this week
- A list of useful CyberChef recipes☆17Jun 20, 2025Updated last year
- Draugnet is a lightweight, open-source tool for anonymous cyber threat reporting. Built for the MISP ecosystem, it lets users submit and …☆21Jul 8, 2026Updated 3 months ago
- Threat Simulator for Enterprise Networks☆15May 14, 2022Updated 4 years ago
- A Compiler from Sigma rules to VQL☆20May 18, 2026Updated 4 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- AIL project training materials☆39Apr 21, 2026Updated 5 months ago
- ☆19Jan 31, 2025Updated last year
- Pythonic way to work with the warning lists defined there: https://github.com/MISP/misp-warninglists☆36May 11, 2026Updated 5 months ago
- Threat Detection Rules (Snort/Sigma/Yara)☆14Jan 23, 2024Updated 2 years ago
- Community-driven catalog of ready-to-use agents for the Security Copilot portal.☆28Feb 24, 2026Updated 7 months ago
- Threat Hunting queries of multiple platforms☆85Sep 24, 2026Updated 2 weeks ago
- service to convert nfcapd files clickhouse as they are created☆10Mar 22, 2025Updated last year
- PowerShell tool for streamlined Microsoft Defender Advanced Hunting query management with GitHub Copilot integration☆21Aug 31, 2026Updated last month
- Block ads and malicious domains with response policy zones☆12Jun 10, 2020Updated 6 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Automate forensic traige package collection and evidence parsing with KAPE and Crowdstrike☆15Mar 5, 2022Updated 4 years ago
- NextThingCo C.H.I.P. linux repository retrieved for use with meta-chip Yocto meta layer☆10Nov 8, 2018Updated 7 years ago
- Splunk Stuffs!☆14Oct 14, 2023Updated 3 years ago
- Get notified when your favourite Twitch streamers stream your favourite categories☆15Jan 24, 2022Updated 4 years ago
- Tools and scripts to deploy and manage OpenRelik instances☆17Mar 23, 2026Updated 6 months ago
- My simple configuration of a TIC(Telegraf, InfluxDB and Chronograf), Speedtest and Grafana, to follow my network speed and quality☆11Oct 5, 2026Updated last week
- Turn any blog into structured threat intelligence.☆63Sep 18, 2026Updated 3 weeks ago
- High-level Threat Intelligence playbooks☆21Mar 6, 2021Updated 5 years ago
- Atlas is infrastructure for continual learning in LLM agents.☆17Jan 24, 2026Updated 8 months ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- command line tool to use the DNSDB Flexible Search API extensions.☆17Aug 5, 2024Updated 2 years ago
- This directory contains presentations and related materials of my speaking engagements. I also use this to record historical presentation…☆18Feb 13, 2025Updated last year
- Detects and reports malicious clipboard content (PowerShell, mshta, etc.) on any page, with user alerts.☆16Oct 5, 2025Updated last year
- Pure Python netflow (1K PPS!) and DNS correlation, with reusable Frame Streams, DnsTap and Protobuf implementations☆18Updated this week
- ☆75Oct 6, 2026Updated last week
- automatically check all downloads against 68 anti-virus solutions (through VirusTotal API)☆21Jul 19, 2021Updated 5 years ago
- Simulating Adversary Operations☆99Apr 13, 2018Updated 8 years ago
- A javascript library to convert Outlook *.msg files to *.eml☆11Jun 27, 2024Updated 2 years ago
- Cradlepoint ECM Command Line Interface☆11Mar 7, 2023Updated 3 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Random Powershell scripts☆13Feb 13, 2024Updated 2 years ago
- A CTI program management and production platform built around MISP☆43Updated this week
- Information Stealers Wall of Sheep (IS-WOS)☆11Nov 13, 2020Updated 5 years ago
- A VS Code plugin to execute arbitrary JavaScript code at runtime over a local HTTP endpoint.☆33Feb 10, 2026Updated 8 months ago
- AT-AT (Attack Tree Analysis Tool) is a application that allows users to develop and analyze attack trees. The overall goal is to automati…☆31Aug 17, 2022Updated 4 years ago
- This repository hosts files relating to the TF-CSIRT Reference Security Incident Taxonomy Working Group.☆81May 13, 2026Updated 5 months ago
- Python tool for bulk PDF feature extraction. This tool is a prototype.☆25Jan 9, 2017Updated 9 years ago