ThreatHunting

west-wind/threat-hunting-with-splunk58

Threat detection queries

Provides Splunk queries to detect vulnerability exploitation attempts and subsequent compromise, including threat hunting for MITRE ATT&CK TTPs

inodee/threathunting-spl268

Splunk query library

Provides Splunk code and prototypes for building rules and queries to detect malicious activity

sbousseaden/slides372

Threat hunting tools

Collection of resources and concepts for threat hunting and detection engineering.

a3sal0n/cyberthreathunting861

Threat Hunting Platform

A collection of tools and resources for threat hunters to identify and respond to cyber threats.

otrf/threathunter-playbook4K

Threat Hunter

A community-driven project providing shared detection logic and resources for threat hunting

threathuntingproject/threathunting1.7K

Threat detection resource

An informational repository providing resources and knowledge for detecting adversaries in IT environments.

ninoseki/mihari870

Threat hunter

An aggregator tool for querying multiple services to gather threat intelligence data.

miladaslaner/threathunt134

Threat simulator

A PowerShell repository to simulate and train threat hunting skills without malicious files.

gossithedog/threathunting570

Domain scanner

Tools and rules for detecting malicious domain calls in endpoint malware

matamorphosis/scrummage515

Threat hunter

A platform for searching and analyzing publicly available online data to detect potential security threats

sk4la/plast17

Threat detection framework

A modular threat-hunting tool framework for detecting indicators of compromise in incident-response operations.

netevert/sentinel-attack1.1K

Threat hunter

A tool to quickly deploy a threat hunting capability on Azure Sentinel using Sysmon and MITRE ATT&CK

phantomcyber/playbooks478

Threat playbook library

Community-developed playbooks and custom functions for Splunk SOAR threat hunting and incident response

sapphirex00/threat-hunting257

Malware toolkit

A collection of threat intelligence resources and tools for analyzing APT malware

stamusnetworks/kts740

IDPS templates

Templates and dashboards for threat hunting with Suricata IDPS/NSM and the ELK 7 stack