This repository contains various threat hunting tools written in Python and is documented in the series Python Threat Hunting Tools which can be found at Kraven Security - Python Threat Hunting Tools. Feel free to use, expand, and adapt these tools as you learn how to create your own tools to hunt for threats!
☆19Nov 16, 2023Updated 2 years ago
Alternatives and similar repositories for python-threat-hunting-tools
Users that are interested in python-threat-hunting-tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A project designed to make the operationalization of open-source cyber threat intelligence more efficient.☆19Updated this week
- A list of useful CyberChef recipes☆17Jun 20, 2025Updated last year
- Threat Simulator for Enterprise Networks☆14May 14, 2022Updated 4 years ago
- A Compiler from Sigma rules to VQL☆19May 18, 2026Updated 2 months ago
- My external brain for cyber defense (WIP). A practical collection of field notes on hunting strategies and system principles. Documentin…☆103Updated this week
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- AIL project training materials☆39Apr 21, 2026Updated 3 months ago
- This project provides a set of Google Apps Scripts designed to help you identify and analyze potentially malicious domains directly from …☆14Sep 4, 2024Updated last year
- CVE-2018-9276 PRTG < 18.2.39 Reverse Shell (Python3 support)☆19Dec 22, 2022Updated 3 years ago
- ThreatTrack | Shodan + ExploitDB + GitHub + NVD☆17Jun 27, 2026Updated last month
- Community-driven catalog of ready-to-use agents for the Security Copilot portal.☆25Feb 24, 2026Updated 5 months ago
- Pythonic way to work with the warning lists defined there: https://github.com/MISP/misp-warninglists☆36May 11, 2026Updated 3 months ago
- Threat Detection Rules (Snort/Sigma/Yara)☆14Jan 23, 2024Updated 2 years ago
- Threat Hunting queries of multiple platforms☆80Updated this week
- service to convert nfcapd files clickhouse as they are created☆10Mar 22, 2025Updated last year
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- PowerShell tool for streamlined Microsoft Defender Advanced Hunting query management with GitHub Copilot integration☆18Updated this week
- Block ads and malicious domains with response policy zones☆12Jun 10, 2020Updated 6 years ago
- Splunk Stuffs!☆14Oct 14, 2023Updated 2 years ago
- Este script analisa a atividade de arquivos em dispositivos USB removíveis, identificando arquivos que foram copiados ou modificados …☆16Dec 10, 2025Updated 8 months ago
- Tools and scripts to deploy and manage OpenRelik instances☆17Mar 23, 2026Updated 4 months ago
- SkillAegis is a platform to design, run, and monitor exercise scenarios, enhancing skills in applications like MISP and training users in…☆39Jul 20, 2026Updated 3 weeks ago
- High-level Threat Intelligence playbooks☆21Mar 6, 2021Updated 5 years ago
- Atlas is infrastructure for continual learning in LLM agents.☆17Jan 24, 2026Updated 6 months ago
- command line tool to use the DNSDB Flexible Search API extensions.☆16Aug 5, 2024Updated 2 years ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- Detects and reports malicious clipboard content (PowerShell, mshta, etc.) on any page, with user alerts.☆16Oct 5, 2025Updated 10 months ago
- Deep Packet Inspection • Traffic Forensics • Network Threat Detection☆55Feb 20, 2026Updated 5 months ago
- ☆76Updated this week
- automatically check all downloads against 68 anti-virus solutions (through VirusTotal API)☆21Jul 19, 2021Updated 5 years ago
- Simulating Adversary Operations☆99Apr 13, 2018Updated 8 years ago
- A javascript library to convert Outlook *.msg files to *.eml☆11Jun 27, 2024Updated 2 years ago
- Cradlepoint ECM Command Line Interface☆11Mar 7, 2023Updated 3 years ago
- Random Powershell scripts☆13Feb 13, 2024Updated 2 years ago
- A CTI program management and production platform built around MISP☆33Updated this week
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Linux Incident Time Machine - A tool for generating human-readable, event-based timelines from Linux `audit.log` files. Designed for SOC …☆16Jan 6, 2026Updated 7 months ago
- AT-AT (Attack Tree Analysis Tool) is a application that allows users to develop and analyze attack trees. The overall goal is to automati…☆31Aug 17, 2022Updated 3 years ago
- Collection of scripts / samples / snippits around the community service at www.filescan.io☆20Nov 6, 2025Updated 9 months ago
- Python tool for bulk PDF feature extraction. This tool is a prototype.☆25Jan 9, 2017Updated 9 years ago
- Monitors and curates cybersecurity-related repositories weekly (Thursday).☆16Updated this week
- Interface LLMs from within MISP to extract TTPs and threat intel from CTI reports☆18Nov 13, 2023Updated 2 years ago
- A VS Code plugin to execute arbitrary JavaScript code at runtime over a local HTTP endpoint.☆33Feb 10, 2026Updated 6 months ago