This repository contains various threat hunting tools written in Python and is documented in the series Python Threat Hunting Tools which can be found at Kraven Security - Python Threat Hunting Tools. Feel free to use, expand, and adapt these tools as you learn how to create your own tools to hunt for threats!
☆20Nov 16, 2023Updated 2 years ago
Alternatives and similar repositories for python-threat-hunting-tools
Users that are interested in python-threat-hunting-tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A project designed to make the operationalization of open-source cyber threat intelligence more efficient.☆19Updated this week
- A list of useful CyberChef recipes☆17Jun 20, 2025Updated last year
- Threat Simulator for Enterprise Networks☆14May 14, 2022Updated 4 years ago
- A fake DNS server for malware analysis written in Python3☆10Aug 14, 2022Updated 4 years ago
- A Compiler from Sigma rules to VQL☆20May 18, 2026Updated 3 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- My external brain for cyber defense (WIP). A practical collection of field notes on hunting strategies and system principles. Documentin…☆104Aug 27, 2026Updated last week
- AIL project training materials☆39Apr 21, 2026Updated 4 months ago
- ☆19Jan 31, 2025Updated last year
- This project provides a set of Google Apps Scripts designed to help you identify and analyze potentially malicious domains directly from …☆14Sep 4, 2024Updated last year
- DetecTI-CLI is a high-performance Python 3.11+ CLI tool designed for External Attack Surface Management (EASM), Reconnaissance, and Vulne…☆19Updated this week
- Community-driven catalog of ready-to-use agents for the Security Copilot portal.☆26Feb 24, 2026Updated 6 months ago
- Pythonic way to work with the warning lists defined there: https://github.com/MISP/misp-warninglists☆36May 11, 2026Updated 3 months ago
- Threat Detection Rules (Snort/Sigma/Yara)☆14Jan 23, 2024Updated 2 years ago
- Threat Hunting queries of multiple platforms☆84Aug 13, 2026Updated 3 weeks ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- PowerShell tool for streamlined Microsoft Defender Advanced Hunting query management with GitHub Copilot integration☆21Updated this week
- Block ads and malicious domains with response policy zones☆12Jun 10, 2020Updated 6 years ago
- Automate forensic traige package collection and evidence parsing with KAPE and Crowdstrike☆15Mar 5, 2022Updated 4 years ago
- NextThingCo C.H.I.P. linux repository retrieved for use with meta-chip Yocto meta layer☆10Nov 8, 2018Updated 7 years ago
- Splunk Stuffs!☆14Oct 14, 2023Updated 2 years ago
- Get notified when your favourite Twitch streamers stream your favourite categories☆15Jan 24, 2022Updated 4 years ago
- Turn any blog into structured threat intelligence.☆63Updated this week
- command line tool to use the DNSDB Flexible Search API extensions.☆17Aug 5, 2024Updated 2 years ago
- Building and Automating Penetration Testing Labs in the Cloud, published by Packt☆21Apr 22, 2026Updated 4 months ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- This directory contains presentations and related materials of my speaking engagements. I also use this to record historical presentation…☆18Feb 13, 2025Updated last year
- Detects and reports malicious clipboard content (PowerShell, mshta, etc.) on any page, with user alerts.☆16Oct 5, 2025Updated 10 months ago
- ☆76Updated this week
- automatically check all downloads against 68 anti-virus solutions (through VirusTotal API)☆21Jul 19, 2021Updated 5 years ago
- A javascript library to convert Outlook *.msg files to *.eml☆11Jun 27, 2024Updated 2 years ago
- Cradlepoint ECM Command Line Interface☆11Mar 7, 2023Updated 3 years ago
- Random Powershell scripts☆13Feb 13, 2024Updated 2 years ago
- A CTI program management and production platform built around MISP☆35Updated this week
- AT-AT (Attack Tree Analysis Tool) is a application that allows users to develop and analyze attack trees. The overall goal is to automati…☆31Aug 17, 2022Updated 4 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- This repository hosts files relating to the TF-CSIRT Reference Security Incident Taxonomy Working Group.☆80May 13, 2026Updated 3 months ago
- Collection of scripts / samples / snippits around the community service at www.filescan.io☆20Nov 6, 2025Updated 9 months ago
- Interface LLMs from within MISP to extract TTPs and threat intel from CTI reports☆18Nov 13, 2023Updated 2 years ago
- Monitors and curates cybersecurity-related repositories weekly (Thursday).☆17Aug 27, 2026Updated last week
- A VS Code plugin to execute arbitrary JavaScript code at runtime over a local HTTP endpoint.☆34Feb 10, 2026Updated 6 months ago
- Hunting IOCs all day every day...☆88Sep 26, 2023Updated 2 years ago
- Persistent memory for AI coding agents.☆23Apr 28, 2026Updated 4 months ago