nccgroup / JA3_outlier
Incremental Machine Leaning by example - Detecting suspicious activity in real time with Zeek data streams, River and JA3 hashes
☆15Updated 2 years ago
Alternatives and similar repositories for JA3_outlier:
Users that are interested in JA3_outlier are comparing it to the libraries listed below
- An elevated STIX representation of the MITRE ATT&CK Groups knowledge base☆23Updated 2 years ago
- Log aggregation, analysis, alerting and correlation for Windows, Syslog and text based logs.☆24Updated 8 years ago
- A few quick recipes for those that do not have much time during the day☆22Updated 5 months ago
- ☆24Updated 2 years ago
- Threat Detection Rules (Snort/Sigma/Yara)☆13Updated last year
- ☆11Updated 4 years ago
- ☆22Updated 4 years ago
- Windows Security Logging☆43Updated 2 years ago
- A dataset of phishing kits in the wild☆15Updated 10 months ago
- ☆9Updated 6 years ago
- Check IOC provided by a MISP instance on Suricata events☆17Updated 5 years ago
- Winterfell hunt is a python script to perform auto threat hunting for malicious activities in windows OS based on collected data by winte…☆15Updated 4 years ago
- Presentation materials for talks I've given.☆20Updated 5 years ago
- Speaking materials from conferences I've given☆9Updated 2 years ago
- CyCAT.org taxonomies☆14Updated 3 years ago
- The FastIR Server is a Web server to schedule FastIR Collector forensics collect thanks to the FastIR Agent☆12Updated 7 years ago
- Converts Sigma detection rules to a Splunk alert configuration.☆13Updated 3 years ago
- ☆18Updated 6 years ago
- Links to malware-related YARA rules☆15Updated 2 years ago
- HoneyDB Python Module☆13Updated last year
- IOCPARSER.COM is a Fast and Reliable service that enables you to extract IOCs and intelligence from different data sources.☆34Updated 3 years ago
- A script to assist in processing forensic RAM captures for malware triage☆27Updated 4 years ago
- A script to create and assign SOP tasks into the cases☆19Updated 4 years ago
- Utility for parsing Bro log files into CSV or JSON format☆41Updated 2 years ago
- ☆21Updated 3 years ago
- Zeek plugin to generate data on per-packet sizes and intervals☆14Updated 4 years ago
- Searches for Insider Threat Hunting☆31Updated 5 years ago
- SACTI - Securely aggregate CTI sightings and report them on MISP☆13Updated 2 years ago
- An extendable tool to extract and aggregate IoCs from threat feeds☆33Updated last year
- Collection of scripts used to analyse malware or emails☆19Updated 4 years ago