• Stars
    star
    3,062
  • Rank 14,715 (Top 0.3 %)
  • Language
  • Created almost 7 years ago
  • Updated about 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

โœจ A curated list of awesome threat detection and hunting resources ๐Ÿ•ต๏ธโ€โ™‚๏ธ

Awesome Threat Detection and Hunting

Awesome

A curated list of awesome threat detection and hunting resources

Contents

Tools

  • MITRE ATT&CK Navigator (source code) - The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel.
  • HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
  • DetectionLab - Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices.
  • Revoke-Obfuscation - PowerShell Obfuscation Detection Framework.
  • Invoke-ATTACKAPI - A PowerShell script to interact with the MITRE ATT&CK Framework via its own API.
  • Unfetter - A reference implementation provides a framework for collecting events (process creation, network connections, Window Event Logs, etc.) from a client machine and performing CAR analytics to detect potential adversary activity.
  • Flare - An analytical framework for network traffic and behavioral analytics.
  • RedHunt-OS - A Virtual Machine for Adversary Emulation and Threat Hunting. RedHunt aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment.
  • Oriana - Lateral movement and threat hunting tool for Windows environments built on Django comes Docker ready.
  • Bro-Osquery - Bro integration with osquery
  • Brosquery - A module for osquery to load Bro logs into tables
  • DeepBlueCLI - A PowerShell Module for Hunt Teaming via Windows Event Logs
  • Uncoder - An online translator for SIEM saved searches, filters, queries, API requests, correlation and Sigma rules
  • CimSweep - A suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows
  • Dispatch - An open-source crisis management orchestration framework
  • EQL - Event Query Language
    • EQLLib - The Event Query Language Analytics Library (eqllib) is a library of event based analytics, written in EQL to detect adversary behaviors identified in MITRE ATT&CKโ„ข.
  • BZAR (Bro/Zeek ATT&CK-based Analytics and Reporting) - A set of Zeek scripts to detect ATT&CK techniques
  • Security Onion - An open-source Linux distribution for threat hunting, security monitoring, and log management. It includes ELK, Snort, Suricata, Zeek, Wazuh, Sguil, and many other security tools
  • Varna - A quick & cheap AWS CloudTrail Monitoring with Event Query Language (EQL)
  • BinaryAlert - Serverless, real-time & retroactive malware detection
  • hollows_hunter - Scans all running processes, recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
  • ThreatHunting - A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
  • Sentinel Attack - A repository of Azure Sentinel alerts and hunting queries leveraging sysmon and the MITRE ATT&CK framework
  • Brim - A desktop application to efficiently search large packet captures and Zeek logs
  • YARA - The pattern matching swiss knife
  • Intel Owl - An Open Source Intelligence, or OSINT solution to get threat intelligence data about a specific file, an IP or a domain from a single API at scale.
  • Capa - An open-source tool to identify capabilities in executable files.
  • Splunk Security Content Splunk-curated detection content that can easily be used accross many SIEMs (see Uncoder Rule Converter.)
  • Threat Bus - Threat intelligence dissemination layer to connect security tools through a distributed publish/subscribe message broker.
  • VAST - A network telemetry engine for data-driven security investigations.
  • zeek2es - An open source tool to convert Zeek logs to Elastic/OpenSearch. You can also output pure JSON from Zeek's TSV logs!
  • LogSlash: A standard for reducing log volume without sacrificing analytical capability.
  • SOC-Multitool: A powerful and user-friendly browser extension that streamlines investigations for security professionals.
  • Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, Kafka and Spark.
  • ProcMon for Linux
  • Synthetic Adversarial Log Objects (SALO) - A framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event.

Detection, Alerting and Automation Platforms

  • ElastAlert - A framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch
  • StreamAlert - A serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define
  • Matano: An open source security lake platform (SIEM alternative) for threat hunting, detection and response on AWS. Matano lets you write advanced detections as code (using python) to correlate and alert on threats in realtime.
  • Shuffle: A general purpose security automation platform.

Endpoint Monitoring

  • osquery (github) - SQL powered operating system instrumentation, monitoring, and analytics
  • Kolide Fleet - A flexible control server for osquery fleets
  • Zeek Agent - An endpoint monitoring agent that provides host activity to Zeek
  • Velociraptor - Endpoint visibility and collection tool
  • Sysdig - A tool for deep Linux system visibility, with native support for containers. Think about sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce
  • go-audit - An alternative to the Linux auditd daemon
  • Sysmon - A Windows system service and device driver that monitors and logs system activity to the Windows event log
  • Sysmon for Linux
  • OSSEC - An open-source Host-based Intrusion Detection System (HIDS)
  • WAZUH - An open-source security platform

Configuration

  • sysmon-DFIR - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
  • sysmon-config - Sysmon configuration file template with default high-quality event tracing.
  • sysmon-modular - A repository of sysmon configuration modules. It also includes a mapping of Sysmon configurations to MITRE ATT&CK techniques.
  • auditd configuration
  • osquery-configuration - A repository for using osquery for incident detection and response.

Network Monitoring

  • Zeek (formerly Bro) - A network security monitoring tool
  • ntopng - A web-based network traffic monitoring tool
  • Suricata - A network threat detection engine
  • Snort (github) - A network intrusion detection tool
  • Joy - A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring
  • Netcap - A framework for secure and scalable network traffic analysis
  • Moloch - A large scale and open source full packet capture and search tool
  • Stenographer - A full-packet-capture tool

Fingerprinting Tools

  • JA3 - A method for profiling SSL/TLS Clients and Servers
  • HASSH - Profiling Method for SSH Clients and Servers
  • RDFP - Zeek Remote desktop fingerprinting script based on FATT (Fingerprint All The Things)
  • FATT - A pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
  • FingerprinTLS - A TLS fingerprinting method
  • Mercury - Network fingerprinting and packet metadata capture
  • GQUIC Protocol Analyzer for Zeek
  • Recog - A framework for identifying products, services, operating systems, and hardware by matching fingerprints against data returned from various network probes
  • Hfinger - Fingerprinting HTTP requests
  • JARM - An active Transport Layer Security (TLS) server fingerprinting tool.

Detection Rules

Dataset

Resources

Frameworks

  • MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversaryโ€™s lifecycle and the platforms they are known to target.
  • Alerting and Detection Strategies Framework - A framework for developing alerting and detection strategies.
  • A Simple Hunting Maturity Model - The Hunting Maturity Model describes five levels of organizational hunting capability, ranging from HMM0 (the least capability) to HMM4 (the most).
  • The Pyramic of Pain - The relationship between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them.
  • A Framework for Cyber Threat Hunting
  • The PARIS Model - A model for threat hunting.
  • Cyber Kill Chain - It is part of the Intelligence Driven Defenseยฎ model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective.
  • The DML Model - The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks.
  • NIST Cybersecurity Framework
  • OSSEM (Open Source Security Events Metadata) - A community-led project that focuses on the documentation and standardization of security event logs from diverse data sources and operating systems.
  • Open Cybersecurity Schema Framework (OCSF) - A framework for creating schemas and it also delivers a cybersecurity event schema built with the framework (schema browser).
  • MITRE Engage - A framework for planning and discussing adversary engagement operations that empowers you to engage your adversaries and achieve your cybersecurity goals.
  • MaGMa Use Case Defintion Model - A business-centric approach for planning and defining threat detection use cases.

Windows

Sysmon

PowerShell

MacOS

Osquery

DNS

Fingerprinting

Data Science

Research Papers

Blogs

Related Awesome Lists

Podcasts

Newsletters

Videos

Trainings

  • Applied Network Defense courses by Chris Sanders
    • Investigation theory, Practical threat hunting, Detection engineering with Sigma, etc.
  • Security Blue Team (BTL1 and BTL2 certificates)
  • LetsDefend - Hands-On SOC Analyst Training
  • TryHackMe - Hands-on cyber security training through real-world scenarios.
  • 13Cubed, Investigating Windows Endpoints by Richard Davis
  • HackTheBox - While not directly related to threat detection, the website features training modules on general security and offensive topics that can be beneficial for junior SOC analysts.

Labs

  • DetectionLab - Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices.
  • Splunk Boss of the SOC - Hands-on workshops and challenges to practice threat hunting using the BOTS and other datasets.
  • HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
  • BlueTeam Lab - A detection lab created with Terraform and Ansible in Azure.
  • attack_range - A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk.

Twitter

Threat Simulation Tools

  • MITRE CALDERA - An automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks.
  • APTSimulator - A Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.
  • Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework.
  • Network Flight Simulator - flightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
  • Metta - A security preparedness tool to do adversarial simulation.
  • Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
  • SharpShooter - Payload Generation Framework.
  • CACTUSTORCH - Payload Generation for Adversary Simulations.
  • DumpsterFire - A modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events.
  • Empire(website) - A PowerShell and Python post-exploitation agent.
  • PowerSploit - A PowerShell Post-Exploitation Framework.
  • RedHunt-OS - A Virtual Machine for Adversary Emulation and Threat Hunting. RedHunt aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment.
  • Infection Monkey - An open source Breach and Attack Simulation (BAS) tool that assesses the resiliency of private and public cloud environments to post-breach attacks and lateral movement.
  • Splunk Attack Range - A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk.

Threat Simulation Resources

Contribute

Contributions welcome! Read the contribution guidelines first.

License

CC0

To the extent possible under law, Adel "0x4D31" Karimi has waived all copyright and related or neighboring rights to this work.

More Repositories

1

awesome-oscp

A curated list of awesome OSCP resources
2,159
star
2

fatt

FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
Python
625
star
3

honeyLambda

honeyฮป - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway
Python
499
star
4

burpa

Burp-Automator: A Burp Suite Automation Tool with Slack Integration. It can be used with Jenkins and Selenium to automate Dynamic Application Security Testing (DAST).
Python
479
star
5

deception-as-detection

Deception based detection techniques mapped to the MITREโ€™s ATT&CK framework
273
star
6

honeybits

A PoC tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your systems to lure the attacker toward your honeypots
Go
267
star
7

salt-scanner

Linux vulnerability scanner based on Salt Open and Vulners audit API, with Slack notifications and JIRA integration
Python
262
star
8

detection-and-response-pipeline

โœจ A compilation of suggested tools/services for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. ๐Ÿ‘ท ๐Ÿ—
219
star
9

sqhunter

A simple threat hunting tool based on osquery, Salt Open and Cymon API
Python
65
star
10

honeyku

A Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens).
Python
58
star
11

hassh-utils

hassh-utils: Nmap NSE Script and Docker image for HASSH - the SSH client/server fingerprinting method (https://github.com/salesforce/hassh)
Lua
49
star
12

honeybits-win

Windows version of honeybits - a PoC tool to create breadcrumbs and honeytokens, to lead the attackers to your honeypots!
Go
24
star
13

quick

QUICk - a go library based on gopacket for analyzing QUIC CHLO messages
Go
22
star
14

Presentations

Some of the presentations given by me
15
star
15

0x4d31.github.io

HTML
2
star