This repository contains various threat hunting tools written in Python and is documented in the series Python Threat Hunting Tools which can be found at Kraven Security - Python Threat Hunting Tools. Feel free to use, expand, and adapt these tools as you learn how to create your own tools to hunt for threats!
☆22Nov 16, 2023Updated 2 years ago
Alternatives and similar repositories for python-threat-hunting-tools
Users that are interested in python-threat-hunting-tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A project designed to make the operationalization of open-source cyber threat intelligence more efficient.☆21Updated this week
- A list of useful CyberChef recipes☆17Jun 20, 2025Updated last year
- Threat Simulator for Enterprise Networks☆15May 14, 2022Updated 4 years ago
- A Compiler from Sigma rules to VQL☆20May 18, 2026Updated 4 months ago
- My external brain for cyber defense (WIP). A practical collection of field notes on hunting strategies and system principles. Documentin…☆104Aug 27, 2026Updated 3 weeks ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- AIL project training materials☆39Apr 21, 2026Updated 5 months ago
- ☆19Jan 31, 2025Updated last year
- This project provides a set of Google Apps Scripts designed to help you identify and analyze potentially malicious domains directly from …☆14Sep 4, 2024Updated 2 years ago
- CVE-2018-9276 PRTG < 18.2.39 Reverse Shell (Python3 support)☆18Dec 22, 2022Updated 3 years ago
- Pythonic way to work with the warning lists defined there: https://github.com/MISP/misp-warninglists☆36May 11, 2026Updated 4 months ago
- Threat Detection Rules (Snort/Sigma/Yara)☆14Jan 23, 2024Updated 2 years ago
- Threat Hunting queries of multiple platforms☆84Sep 9, 2026Updated 2 weeks ago
- Community-driven catalog of ready-to-use agents for the Security Copilot portal.☆27Feb 24, 2026Updated 6 months ago
- service to convert nfcapd files clickhouse as they are created☆10Mar 22, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- PowerShell tool for streamlined Microsoft Defender Advanced Hunting query management with GitHub Copilot integration☆21Aug 31, 2026Updated 3 weeks ago
- Automate forensic traige package collection and evidence parsing with KAPE and Crowdstrike☆15Mar 5, 2022Updated 4 years ago
- Splunk Stuffs!☆14Oct 14, 2023Updated 2 years ago
- Get notified when your favourite Twitch streamers stream your favourite categories☆15Jan 24, 2022Updated 4 years ago
- Tools and scripts to deploy and manage OpenRelik instances☆17Mar 23, 2026Updated 6 months ago
- My simple configuration of a TIC(Telegraf, InfluxDB and Chronograf), Speedtest and Grafana, to follow my network speed and quality☆11Sep 14, 2026Updated last week
- SkillAegis is a platform to design, run, and monitor exercise scenarios, enhancing skills in applications like MISP and training users in…☆39Jul 20, 2026Updated 2 months ago
- Turn any blog into structured threat intelligence.☆63Updated this week
- High-level Threat Intelligence playbooks☆21Mar 6, 2021Updated 5 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Atlas is infrastructure for continual learning in LLM agents.☆17Jan 24, 2026Updated 7 months ago
- command line tool to use the DNSDB Flexible Search API extensions.☆17Aug 5, 2024Updated 2 years ago
- This directory contains presentations and related materials of my speaking engagements. I also use this to record historical presentation…☆18Feb 13, 2025Updated last year
- Detects and reports malicious clipboard content (PowerShell, mshta, etc.) on any page, with user alerts.☆16Oct 5, 2025Updated 11 months ago
- Deep Packet Inspection • Traffic Forensics • Network Threat Detection☆56Feb 20, 2026Updated 7 months ago
- Pure Python netflow (1K PPS!) and DNS correlation, with reusable Frame Streams, DnsTap and Protobuf implementations☆18Updated this week
- ☆76Aug 28, 2026Updated 3 weeks ago
- automatically check all downloads against 68 anti-virus solutions (through VirusTotal API)☆21Jul 19, 2021Updated 5 years ago
- Simulating Adversary Operations☆99Apr 13, 2018Updated 8 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- A javascript library to convert Outlook *.msg files to *.eml☆11Jun 27, 2024Updated 2 years ago
- Cradlepoint ECM Command Line Interface☆11Mar 7, 2023Updated 3 years ago
- ☆20Jun 3, 2024Updated 2 years ago
- Linux Incident Time Machine - A tool for generating human-readable, event-based timelines from Linux `audit.log` files. Designed for SOC …☆16Aug 23, 2026Updated last month
- Random Powershell scripts☆13Feb 13, 2024Updated 2 years ago
- A CTI program management and production platform built around MISP☆39Updated this week
- Information Stealers Wall of Sheep (IS-WOS)☆11Nov 13, 2020Updated 5 years ago