salesforce / multithreaded-exfil-detection
A simple way of detecting multithreaded exfiltration in Zeek.
☆14Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for multithreaded-exfil-detection
- Remote Desktop Client Fingerprint script for Zeek. Based off of https://github.com/0x4D31/fatt☆37Updated last year
- List of sigma for a variety of threats for multiple log sources.☆11Updated 6 years ago
- A repository of Sysmon For Linux configuration modules☆15Updated 3 years ago
- Links to malware-related YARA rules☆14Updated 2 years ago
- A list of IOCs applicable to PoshC2☆24Updated 4 years ago
- Threat Mapping Catalogue☆17Updated 3 years ago
- Zeek Extension to Collect Metadata for Profiling of Endpoints and Proxies☆25Updated 8 months ago
- Bluehat 2018 Graphs for Security Workshop☆42Updated 6 years ago
- ☆12Updated 2 years ago
- Bro integration with osquery☆15Updated last year
- A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for…☆35Updated 2 years ago
- ☆53Updated 5 years ago
- Automated detection rule analysis utility☆29Updated 2 years ago
- A CALDERA plugin for ATT&CK Evaluations Round 1☆33Updated last year
- An elevated STIX representation of the MITRE ATT&CK Groups knowledge base☆23Updated 2 years ago
- ☆43Updated last year
- Threat Detection Rules (Snort/Sigma/Yara)☆13Updated 10 months ago
- A tool to assess data quality, built on top of the awesome OSSEM.☆76Updated 2 years ago
- Import specific data sources into the Sigma generic and open signature format.☆77Updated 2 years ago
- A completely unsupported set of scripts used in SANS FOR572, Advanced Network Forensics and Analysis☆23Updated 4 months ago
- Zeek package to detect Zerologon☆11Updated 3 years ago
- ☆41Updated 7 months ago
- Library of threat hunts to get any user started!☆40Updated 4 years ago
- Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.☆76Updated 2 years ago
- Cloud Templates and scripts to deploy mordor environments☆127Updated 3 years ago
- Look into EDR events from network☆23Updated 7 months ago
- A simple command line program to help defender test their detections for network beacon patterns and domain fronting☆65Updated 2 years ago
- This repository includes a mapping table and a reference process that allows converting between STIX 2.1 Course of Action objects that ma…☆15Updated 2 years ago