kunai-project / kunai
Threat-hunting tool for Linux
☆420Updated this week
Alternatives and similar repositories for kunai:
Users that are interested in kunai are comparing it to the libraries listed below
- Deep Linux runtime visibility meets Wireshark☆255Updated this week
- Automated YARA Rule Standardization and Quality Assurance Tool☆179Updated last week
- CLI tools for forensic investigation of Windows artifacts☆321Updated 2 months ago
- Red Canary's eBPF Sensor☆101Updated 6 months ago
- Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.☆149Updated this week
- Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streaml…☆184Updated this week
- Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)☆419Updated this week
- Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis…☆230Updated this week
- A centralized and enhanced memory analysis platform☆404Updated last month
- A standard for reducing log volume without sacrificing analytical capability☆198Updated last year
- This is a collection of threat detection rules / rules engines that I have come across.☆277Updated 8 months ago
- Signatures and IoCs from public Volexity blog posts.☆345Updated last month
- Rapidly Search and Hunt through Linux Forensics Artifacts☆183Updated last year
- The Sigma command line interface based on pySigma☆141Updated 3 weeks ago
- A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and contr…☆175Updated 3 weeks ago
- A rewrite of YARA in Rust.☆693Updated this week
- Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of par…☆252Updated 2 months ago
- Customizable Linux Persistence Tool for Security Research and Detection Engineering.☆496Updated 2 weeks ago
- MITRE Caldera™ for OT Plugins & Capabilities☆202Updated 2 months ago
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆145Updated 3 months ago
- Transform Linux Audit logs for SIEM usage☆730Updated this week
- A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat in…☆219Updated this week
- A collection of companies that disclose adversary TTPs after they have been breached☆243Updated 8 months ago
- How to setup a honeypot with an IDS, ELK and TLS traffic inspection☆154Updated 2 years ago
- ☆121Updated this week
- LOKI2 - Simple IOC and YARA Scanner☆84Updated 5 months ago
- Advanced Bash script designed for conducting digital forensics on Linux systems☆138Updated 9 months ago
- MISP Playbooks☆182Updated last month
- A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you com…☆166Updated 2 months ago
- DFIQ is a collection of investigative questions and the approaches for answering them☆266Updated this week