Security Operations

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

Collection of Cyber Threat Intelligence sources from the deep and dark web

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

IntelOwl: manage your Threat Intelligence at scale

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Open-source security automation platform for teams and AI agents

Open-source AI-powered offensive security harness for automated penetration testing.

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 1080+ actively maintained scan vectors (200+ email / 880+ username) for security research, investigations, and digital footprinting.

Collaborative Incident Response platform

Malicious traffic detection system

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Threat-hunting tool for Linux

A curated knowledge base to build, run and mature a SOC (including CSIRT).

Go security checker

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.

Transform Linux Audit logs for SIEM usage

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Automation to assess the state of your M365 tenant against CISA's baselines

FAME Automates Malware Evaluation

SIEM Tactics, Techiques, and Procedures

The FLARE team's open-source tool to identify capabilities in executable files.

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Agentic offensive-security in your terminal

openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.

gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID

Offensive security platform that automates attack surface discovery and vulnerability management

Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats

Firmware Analysis and Comparison Tool

Yet another Ransomware gang tracker

Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.

Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

Tenzir is the data pipeline engine for security teams.

Unlock the full brightness of the XDR display of your MacBook Pro

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

Repositório criado com intuito de reunir expressões regulares dentro do contexto Brasil

Make production Rust binaries auditable

Cortex: a Powerful Observable Analysis and Active Response Engine

Automated pentest reporting with custom templates, project tracking, customer dashboard and client management tools. Streamline your security workflows effortlessly!

Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.

Cross-platform incident response and live forensics toolkit with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.

The CrowdStrike Falcon SDK for Python

Autonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification.

10-20x more blocks for your CrowdSec bouncers — 120k+ IPs from 32 free threat feeds

AI-native red-team workbench for authorized penetration testing and vulnerability research, with specialist agents, sandboxed tooling, evidence records, and replayable timelines.

PentestCode - Multi-agent AI penetration testing system with persistent engagement state, strategic coordination, and parallel autonomous operations.

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.

Automated Adversary Emulation Platform

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Pen Test Report Generation and Assessment Collaboration

A browser extension for OSINT search

Free educational content on reverse engineering and malware analysis from the FLARE team

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

The Big Brother V7.0 is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.

🐍 High-performance, multi-threaded YARA & IOC scanner

Since 2011, IPBan is the worlds most trusted, free security software to block hackers and botnets. With both Windows and Linux support, IPBan has your dedicated or cloud server protected. Upgrade to IPBan Pro today and get a discount. Learn more at ↓

CLI tool for open source and threat intelligence

A query aggregator for OSINT based threat hunting

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

Cortex Analyzers Repository

An Active Defense and EDR software to empower Blue Teams

Unlock your displays on your Mac! Flexible HiDPI scaling, XDR/HDR extra brightness, virtual screens, DDC control, extra dimming, PIP/streaming, EDID override and lots more!

Intelligent adaptive brightness for your external monitors

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

Collection of forensic tools

Open-source attack surface management and authorized security automation platform for asset discovery, service probing, scan orchestration, and security result management.

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.

Forensics artefact collection tool for systems running Microsoft Windows

MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.

Open Cyber Threat Intelligence Platform

Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring, quarantine, and multi-channel alerting

Digging Deeper....

The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

Security sensor for realtime threat detection and protection

Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.

OpenCTI Connectors

Fast and efficient osquery management

Modules for expansion services, enrichment, import and export in MISP and other tools.

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

Zeek-Formatted Threat Intelligence Feeds

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

EDR Lab for Experimentation Purposes

AssemblyLine 4: File triage and malware analysis

Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Typed sync + async clients, 100% v3-compatible, with a built-in MCP server for AI agents.

Fail2Ban UI is a management platform for operating Fail2Ban across one or more Linux hosts. It provides a central place to review bans, search and unban IP addresses, manage jails and filters, and receive notifications.

Suricata rules for network anomaly detection

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

Volatility 3.0 development

A large repository of malware samples with 2500+ malware samples & source codes for a variety of platforms by Cryptware Apps.

Built-in Panther detection rules and policies

66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search, stealer logs

🏴‍☠️💰 Another Ransomware gang tracker

Automation and Scaling of Digital Forensics Tools

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

This Repository is a collection of different ethical hacking tools and malware's for penetration testing and research purpose written in python, ruby, rust, c++, go and c.

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

A resource containing all the tools each ransomware gangs uses

Extract and aggregate threat intelligence.

SCuBA Secure Configuration Baselines and assessment tool for Google Workspace

Scam intelligence, phishing attribution, drainer mapping. Legal OSINT only. Public data. Real cases. For researchers and victims.

YARA signature and IOC database for my scanners and tools

A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.

Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

PowerShell Digital Forensics & Incident Response Scripts.

A script for credentials-based attack surface enumeration and general reconnaissance of massive external networks

iMonitor（冰镜 - 终端行为分析系统）

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

Automatically created C2 Feeds

Security event correlation engine for ELK stack

Open source templates you can use to bootstrap your security programs

Collection of knowledge about information security

This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

BEAR-C2 is an adversary simulation and emulation framework built around real-world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups.

Protect your secrets using Gitleaks-Action

Security automation with n8n ideas: 100+ Red/Blue/AppSec workflows, integrations, and ready-to-run playbooks.

Collection of private Yara rules.

Warning lists to inform users of MISP about potential false-positives or other information in indicators

Clusters and elements to attach to MISP events or attributes (like threat actors)

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

Free educational courses in cybersecurity, reverse engineering, malware analysis, and programming designed to expand access, build practical skills, and support the next generation of cyber defenders.

Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask app, bilingual.

HackerOne "in scope" domains

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Penetration Testing notes, resources and scripts

Infection Monkey - An open-source adversary emulation platform

WIFI / LAN intruder detector. Check the devices connected and alert you with unknown devices. It also warns of the disconnection of "always connected" devices

Signatures and IoCs from public Volexity blog posts.

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

Asset inventory of over 800 public bug bounty programs.

Open-source intelligence archive of crypto scam operations — internal chats, admin panels, victim records, and infrastructure data for research and investigation

The FOFA Library collects usage tips, common scenarios, F&Q, and more for FOFA.

Extracted Yara rules from Windows Defender mpavbase and mpasbase

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.

CyberSecurity BLUE TEAM containerized platform that brings together open-source tools for SIEM, DFIR, CTI, SOAR, and Network Analysis

MISP trainings, threat intel and information sharing training materials with source code

The SOC Analysts all-in-one CLI tool to automate and speed up workflow.

Phishing catcher using Certstream

Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.

Monzo's real-time incident response and reporting tool ⚡️

An IIS short filename enumeration tool

Repository of YARA rules made by Trellix ATR Team

A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

Open Source EDR for Windows

A Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering highly bespoke vulnerabilities and enables running traffic-based analysis of any type.

a tool to help operate in EDRs' blind spots

DFIRTrack - The Incident Response Tracking Application

A powerful and user-friendly browser extension that streamlines investigations for security professionals.

A repository for using osquery for incident detection and response

A Holistic OSINT and Threat Hunting Platform

:wolf: Malware analysis platform

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

CI/CD Security Analyzer

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

A repository of tools for pentesting of restricted and isolated environments.

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

A web honeypot library to create vulnerable-looking endpoints to detect and mislead attackers

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving to other types of threats.

This map lists the essential techniques to bypass anti-virus and EDR

pfSense/OPNsense + Elastic Stack

🚀🚀 This is a 🎇🔥 REAL WORLD🔥 🎇 Malware Collection I have Compiled & analysed by researchers🔥 to understand more about Malware threats😈, analysis and mitigation🧐.

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

Enumerate and disable common sources of telemetry used by AV/EDR.

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

Collection of Event ID ressources useful for Digital Forensics and Incident Response

👀👮🐢🔥Performs a privacy & security check of Windows 10

PacBot (Policy as Code Bot)

Finds security holes in your Python projects from PyCharm and GitHub

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Defanged Indicator of Compromise (IOC) Extractor.

An opensource incident management platform integrating with Slack.

Anomaly Detection on Dynamic (time-evolving) Graphs in Real-time and Streaming manner. Detecting intrusions (DoS and DDoS attacks), frauds, fake rating anomalies.

A knowledge base of actionable Incident Response techniques

Evasive shellcode loader for bypassing event-based injection detection (PoC)

psad: Intrusion Detection and Log Analysis with iptables

NoSql Injection CLI tool, for finding vulnerable websites using MongoDB.

戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑

Ethereum recon and exploitation tool.

Indicators of Compromise from Amnesty International's cyber investigations

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

Information gathering & website reconnaissance | https://phishstats.info/