MISP (core software) - Open Source Threat Intelligence and Sharing Platform (formely known as Malware Information Sharing Platform)

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

Sysmon configuration file template with default high-quality event tracing

The Hunting ELK

A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

A curated list of awesome threat detection and hunting resources

Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale

A curated list of awesome YARA rules, tools, and people.

Signature base for my scanner tools

Your Everyday Threat Intelligence

Windows Events Attack Samples

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Utilities for Sysmon

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

A Linux Auditd rule set mapped to MITRE's Attack Framework

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

An Active Defense and EDR software to empower Blue Teams

Kaspersky's GReAT KLara

Advanced Sysmon configuration, Installer & Auto Updater with high-quality event tracing

FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic

FCL (Fileless Command Lines) - Known command lines of fileless malicious executions

Extract and aggregate threat intelligence.

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

Clusters and elements to attach to MISP events or attributes (like threat actors)

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

Archive of publicly available threat INTel reports (mostly APT Reports but not limited to).

StalkPhish - The Phishing kits stalker, harvesting phishing kits for investigations.