This repository contains various threat hunting tools written in Python and is documented in the series Python Threat Hunting Tools which can be found at Kraven Security - Python Threat Hunting Tools. Feel free to use, expand, and adapt these tools as you learn how to create your own tools to hunt for threats!
☆19Nov 16, 2023Updated 2 years ago
Alternatives and similar repositories for python-threat-hunting-tools
Users that are interested in python-threat-hunting-tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A project designed to make the operationalization of open-source cyber threat intelligence more efficient.☆19Updated this week
- Draugnet is a lightweight, open-source tool for anonymous cyber threat reporting. Built for the MISP ecosystem, it lets users submit and …☆21Jul 8, 2026Updated 2 weeks ago
- Threat Simulator for Enterprise Networks☆14May 14, 2022Updated 4 years ago
- A fake DNS server for malware analysis written in Python3☆10Aug 14, 2022Updated 3 years ago
- A Compiler from Sigma rules to VQL☆19May 18, 2026Updated 2 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- AIL project training materials☆39Apr 21, 2026Updated 3 months ago
- ☆19Jan 31, 2025Updated last year
- This project provides a set of Google Apps Scripts designed to help you identify and analyze potentially malicious domains directly from …☆14Sep 4, 2024Updated last year
- CVE-2018-9276 PRTG < 18.2.39 Reverse Shell (Python3 support)☆19Dec 22, 2022Updated 3 years ago
- ThreatTrack | Shodan + ExploitDB + GitHub + NVD☆17Jun 27, 2026Updated 3 weeks ago
- Pythonic way to work with the warning lists defined there: https://github.com/MISP/misp-warninglists☆36May 11, 2026Updated 2 months ago
- Threat Detection Rules (Snort/Sigma/Yara)☆14Jan 23, 2024Updated 2 years ago
- Threat Hunting queries of multiple platforms☆76Jul 15, 2026Updated last week
- service to convert nfcapd files clickhouse as they are created☆10Mar 22, 2025Updated last year
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- PowerShell tool for streamlined Microsoft Defender Advanced Hunting query management with GitHub Copilot integration☆18Updated this week
- Automate forensic traige package collection and evidence parsing with KAPE and Crowdstrike☆15Mar 5, 2022Updated 4 years ago
- NextThingCo C.H.I.P. linux repository retrieved for use with meta-chip Yocto meta layer☆10Nov 8, 2018Updated 7 years ago
- Splunk Stuffs!☆14Oct 14, 2023Updated 2 years ago
- Get notified when your favourite Twitch streamers stream your favourite categories☆15Jan 24, 2022Updated 4 years ago
- Pure Python netflow (1K PPS!) and DNS correlation, with reusable Frame Streams, DnsTap and Protobuf implementations☆17Jun 20, 2026Updated last month
- Tools and scripts to deploy and manage OpenRelik instances☆17Mar 23, 2026Updated 4 months ago
- My simple configuration of a TIC(Telegraf, InfluxDB and Chronograf), Speedtest and Grafana, to follow my network speed and quality☆10Jun 16, 2026Updated last month
- Replacement aluminum CNC backplate for the MNT Pocket Reform☆13Jan 4, 2025Updated last year
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- High-level Threat Intelligence playbooks☆21Mar 6, 2021Updated 5 years ago
- Atlas is infrastructure for continual learning in LLM agents.☆16Jan 24, 2026Updated 6 months ago
- command line tool to use the DNSDB Flexible Search API extensions.☆16Aug 5, 2024Updated last year
- Building and Automating Penetration Testing Labs in the Cloud, published by Packt☆21Apr 22, 2026Updated 3 months ago
- Detects and reports malicious clipboard content (PowerShell, mshta, etc.) on any page, with user alerts.☆16Oct 5, 2025Updated 9 months ago
- Deep Packet Inspection • Traffic Forensics • Network Threat Detection☆55Feb 20, 2026Updated 5 months ago
- Simulating Adversary Operations☆99Apr 13, 2018Updated 8 years ago
- Cradlepoint ECM Command Line Interface☆11Mar 7, 2023Updated 3 years ago
- Random Powershell scripts☆13Feb 13, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Information Stealers Wall of Sheep (IS-WOS)☆11Nov 13, 2020Updated 5 years ago
- A CTI program management and production platform built around MISP☆32Jun 30, 2026Updated 3 weeks ago
- A VS Code plugin to execute arbitrary JavaScript code at runtime over a local HTTP endpoint.☆29Feb 10, 2026Updated 5 months ago
- AT-AT (Attack Tree Analysis Tool) is a application that allows users to develop and analyze attack trees. The overall goal is to automati…☆31Aug 17, 2022Updated 3 years ago
- Linux Incident Time Machine - A tool for generating human-readable, event-based timelines from Linux `audit.log` files. Designed for SOC …☆16Jan 6, 2026Updated 6 months ago
- Python tool for bulk PDF feature extraction. This tool is a prototype.☆25Jan 9, 2017Updated 9 years ago
- ☆17Feb 17, 2025Updated last year