84
Security lists for SOC/DFIR detections
Awesome Security lists for SOC/CERT/CTI
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
Threat Hunting:
ThreatHunting Yara rules
Yara rules for Threat Hunting sessions
In 2 lists
General
General
🔥 EricZimmerman Tools 🔥
An updated list of forensic tools created by Eric Zimmerman, an instructor for SANS institute.
In 3 lists
arfifacts List - ForensicArtifacts
A free, community-sourced, machine-readable knowledge base of digital forensic artifacts.
In 3 lists
SleuthKit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
In 4 lists
[OS] Remnux
Linux distribution and docker images for malware reverse engineering and analysis.
In 5 listsDetails
[OS] tsurugi
heavily customized Linux distribution that designed to support DFIR investigations, malware analysis and OSINT activities. It is based on Ubuntu 20.04(64-bit with a 5.15.12 custom kernel)
In 5 listsDetails
In 2 lists
PSBits
Simple (relatively) things allowing you to dig a bit deeper than usual.
In 3 lists
ThreatHunting Yara rules
Yara rules for Threat Hunting sessions
In 2 lists
capa
detects capabilities in executable files. You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do.
In 3 lists
[EVTX] Hayabusa
Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan.
In 3 lists
[EVTX] WELA
Windows Event Log Analyzer aims to be the Swiss Army knife for Windows event logs.
In 2 lists
[EVTX] APTHunter
APT-Hunter is Threat Hunting tool for windows event logs.
In 2 lists
[EVTX / Auditd] Zircolite
A standalone and fast SIGMA-based detection tool for EVTX or JSON.
In 2 lists
PersistenceSniper
Powershell module to hunt for persistence implanted in Windows machines.
In 2 lists
Logon Tracer
Tool to investigate malicious Windows logon by visualizing and analyzing Windows event log.
In 5 listsDetails
Timeline Plaso
a Python-based backend engine for the tool log2timeline.
In 2 lists
Timeline TimeSketch
Open source tool for collaborative forensic timeline analysis.
In 5 listsDetails
hollows hunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
In 4 lists
PE sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
In 3 lists
RdpCacheStitcher
RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
In 3 lists
Searching strings - ripgrep
Better and faster grep. Recursively searches directories while respecting gitignore rules and skipping hidden/binary files.; Flavors: Rust (default), PCRE.
In 10 listsDetails
Kape
The tool allows collecting various predefined artifactgs using targets and modules, see KapeFiles which include persistence mechanisms, among others there's a collection of LNK files, scheduled task files and scheduled task listing or a WMI repository auditing module.
In 2 lists
In 2 lists
Velociraptor
Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
In 5 listsDetails
[memory] MemProcFS
An easy and convenient way of accessing physical memory as files a virtual file system.
In 3 lists
[memory] MemProcFS-Analyzer
PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.
In 2 lists
[memory] avml
A portable volatile memory acquisition tool for Linux.
In 3 lists
[memory] Volatility
The volatile memory extraction framework (successor of Volatility)
In 3 lists
[Image Mount] OSFMount
allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive
In 2 lists
[Network] Network Miner
A network forensic tool for PCAP file analysis.
In 2 lists
[Network] Wireshark
Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is very similar to tcpdump, but has a graphical front-end, plus some integrated sorting and filtering options.
In 20 listsDetails
In 2 lists
[Carving] Bulk Extractor
Computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. Because of ignoring the file system structure, the program distinguishes itself in terms of speed and thoroughness.
In 6 listsDetails
[memory] Lime
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD.
In 4 lists
Windows artifacts
[Guide to the various Windows forensic artifacts]
In 2 lists
[Linux] UAC
UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
In 2 lists
[Linux] EXT4 / XFS - fjta
Tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), generates timelines, and detects suspicious activities
In 2 lists
lists - aboutdfir.com
Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges and more
In 2 lists
Monitoring - Osquery
is a SQL powered operating system instrumentation, monitoring, and analytics framework.
In 6 listsDetails
[OSX Tools] mac_apt
Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.
In 4 lists
General
chainabuse (for malicious owned crypto wallets address)
Report and search crypto scam addresses.
In 3 lists
C2IntelFeeds
C2 intelligence feeds for threat hunting.
In 2 lists
Volexity TI
sparkles: :gem:; This repository contains IoCs related to Volexity public threat intelligence blog posts.
In 3 lists
Unit42 Articles IOC
IOCs and supporting data for Palo Alto Networks Unit 42 threat research articles, so indicators can be traced back to their write-up.
In 2 lists
ESET Research IOC
eyes:; Collection of YARA and Snort rules from IOCs collected by ESET researchers. There's about a dozen YARA Rules to glean from in this repo, search for file extension .yar. This repository is seemingly updated on a roughly monthly interval. New IOCs are often mentioned on the ESET…
In 4 lists
Cisco Talos IOC
IOCs from Cisco Talos.
In 2 lists
UrlHaus
Community-driven repository for real-time malicious URL data, offering actionable threat intelligence to block phishing and malware.
In 2 lists
vx-underground - Great Resource for Samples and Intelligence Reports
PL-CERT based open source MWDB python application holding a malware database containing every APT sample from 2010 and over 7.5M maliciousbinaries.
In 2 lists
Ransomware.live
A monitoring ransomware's victims in near real-time.
In 2 lists
General
General
PurpleTeam atomics
A red team attack techniques framework supporting also the MITRE ATT&CK persistence techniques, see e.g. T1044 "File System Permissions Weakness".
In 6 listsDetails
General
PurpleTeam atomics
A red team attack techniques framework supporting also the MITRE ATT&CK persistence techniques, see e.g. T1044 "File System Permissions Weakness".
In 6 listsDetails
redcanary Threat Detection report
Threat Detection Report (2026) - Analyzes the evolving cybersecurity landscape by examining over one hundred thousand confirmed threats across diverse infrastructure and identity environments. Key findings reveal that identity based attacks surged by 850 percent year over year, now accounting for…
In 2 lists
Cyber Kill chain
Lockheed Martin's framework that outlines the 7 stages commonly observed in a cyber attack.
In 2 lists
MITRE CAR
The Cyber Analytics Repository is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) adversary model.
In 3 lists
CVE Vuln Database
Dictionary of common names (i.e., CVE Identifiers) for publicly known security vulnerabilities.
In 3 lists
General
Virustotal
VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means to detect false…
In 13 listsDetails
SpamHaus
Lookup Reputation Checker.
In 2 lists
AbuseIPDB
AbuseIPDB is a project dedicated to helping combat the spread of hackers, spammers, and abusive activity on the internet.
In 5 listsDetails
Malwarebazaar
Share malware samples for research purposes.
In 2 lists
dnsdumpster
DNSdumpster.com is a FREE domain research tool that can discover hosts related to a domain. Finding visible hosts from the attackers perspective is an important part of the security assessment process.
In 5 listsDetails
nslookup.io
Find all DNS records for a domain name using this online tool
In 3 lists
cloudfare URL scan
URL scanner by Cloudflare for security analysis.
In 2 lists
shodan
Shodan is a search engine that lets users search for various types of servers connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client.
In 12 listsDetails
Onyphe
ONYPHE is an Attack Surface Management & Attack Surface Discovery solution built as a Cyber Defense Search Engine. We scan the entire Internet and Dark Web for exposed assets and crawl the links just like a Web search engine. Our data is searchable with a Web form or directly from our numerous APIs.
In 4 listsDetails
haveibeenpwned
Checks if your credentials (Email address or Password) have been compromised in a data breach. See also Firefox Monitor.
In 8 listsDetails
Censys
Search Engine for every server on the Internet to reduce exposure and improve security
In 4 listsDetails
cybergordon (URL reputation check)
CyberGordon is a threat intelligence search engine. It leverages 30+ sources.
In 2 lists
threatminer
ThreatMiner is a threat intelligence portal designed to enable analysts to research under a single interface.
In 4 listsDetails
urlscan
urlscan.io is a free service to scan and analyse websites. When a URL is submitted to urlscan.io, an automated process will browse to the URL like a regular user and record the activity that this page navigation creates.
In 7 listsDetails
urlquery
Free URL Scanner.
In 2 lists
cloudfare scanner
Global Internet traffic, attack, and technology trends and insights
In 3 lists
scamsearch.io
search to find phone, email, profile if is tobe a scammer.
In 3 lists
scamdb.net
Report and Search Online Scams
In 2 lists
urlvoid
Analyzes a website through multiple blacklist engines and online reputation tools to facilitate the detection of fraudulent and malicious websites.
In 3 lists
urldna.io
Unleash website insights! urldna.io analyzes data, monitors brands and exposes security risks
In 4 listsDetails
url checkphish
An online tool that finds registered domain typosquats and analyzes them for suspicious activity.
In 3 lists
ipvoid
IP address reputation and blacklist check.
In 3 lists
mxtoolbox mail header
Email headers are present on every email you receive via the Internet and can provide valuable diagnostic information like hop delays, anti-spam results and more. If you need help getting copies of your email headers
In 2 lists
In 2 lists
pulsedive
A partially free website research tool. Collects detailed information about IP, whois, ssl, dns, ports, threats reports, geolocation, cookies, metadata (fb app id etc). Make screenshots and many others
In 7 listsDetails
threatbook
One step ahead of your adversary with high-fidelity, efficient and actionable cyber threat intelligence
In 3 lists
web archive
Explore more than 702 billion web pages saved over time
In 4 listsDetails
IBM X-Force Exchange
Threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
In 3 lists
AlienVault OTX
Open Threat Exchange is the neighborhood watch of the global intelligence community. It enables private companies, independent security researchers, and government agencies to openly collaborate and share the latest information about emerging threats, attack methods, and malicious actors,…
In 6 listsDetails
url tiny-scan
Free URL inspection online tool: ip, location, desktop/mobile screenshots, number of links, javascript files and stylesheets, technology profile, number of request and bytes transferred and more.
In 4 listsDetails
certificates - crt.sh
Enter an Identity (Domain Name, Organization Name, etc), a Certificate Fingerprint (SHA-1 or SHA-256) or a crt.sh ID to search certificate(s) by @crtsh.
In 6 listsDetails
site web-check
Get detailed report about IP or domain: Location SSL Info Headers Domain and host names Whois DNS records Crawl riles Cookies Server Info Redirects Server status TXT Config
In 3 lists
validin.com
Website and API to search current and historical DNS records for free
In 3 lists
Malware-Traffic-Analysis (PCAP files)
A large collection of malicious PCAP files that can be used to practice packet capture skills.
In 2 lists
redhuntlabs
This Custom Search Tool by @RedHuntLabs Team looks for keywords/strings in following Online IDEs, Paste(s) sites and Code Sharing Platforms.
In 2 lists
whois domaintools
Go beyond ordinary Whois to discover the people or organizations behind a domain name or IP address.
In 6 listsDetails
OUI mac address lookup
An online OUI lookup for searching vendors of MAC addresses.
In 2 lists
macvendorlookup
Look up the vendor for a specific MAC Address
In 2 lists
abuse.ch
ZeuS Tracker / SpyEye Tracker / Palevo Tracker / Feodo Tracker tracks Command&Control servers (hosts) around the world and provides you a domain- and an IP-blocklist.
In 3 lists
waybackmachine
Internet Archive
In 2 lists
In 2 lists
asnlookup
Quickly lookup updated information about specific Autonomous System Number (ASN), Organization, CIDR, or registered IP addresses (IPv4 and IPv6) among other relevant data
In 3 lists
SecurityTrail
Historical and current WHOIS, historical and current DNS records, similar domains, certificate information and other domain and IP related API and tools.
In 6 listsDetails
ZommEye
ZoomEye is a cyberspace search engine for IPs, domains, internet asset discovery, and exposure analysis of servers, routers, and webcams.
In 2 lists
Norton lookup
Look up a site, Get our rating
In 2 lists
Talos Intelligence lookup
IP and Domain Reputation Center for real-time threat detection
In 3 lists
General
In 2 lists
triage
Fully automated solution for high-volume malware analysis using advanced sandboxing technology
In 2 lists
filescan.io
Static malware analysis, VBA/Powershell/VBS/JS Emulation
In 2 lists
Hybrid Analysis
Free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology
In 6 listsDetails
Virustotal
VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means to detect false…
In 13 listsDetails
kaspersky opentip
Scan files, domains, IP addresses, and URLs for threats, malware, viruses
In 2 lists
General
CyberChef
collection of more than a hundred online #tools for automating a wide variety of tasks (string coding, text comparison, double-space removal)
In 6 listsDetails
In 2 lists
JS deobfuscator
HTML/JS deobfuscator
In 2 lists
regex101
Best free and best web-based tester.; Flavors: Java, JavaScript, .NET, PCRE, RE2, Rust, and emulates Python.; Includes regex debugger (PCRE only).
In 6 listsDetails
UrlEncode.org
온라인 url 인코더/디코더
In 2 lists
RegExr
[GitHub] - Best open source tester.; Flavors: JavaScript, PCRE.; Languages: 🇺🇸, 🇨🇳 (fork).
In 4 listsDetails
Pretty Diff
available
In 2 lists
In 2 lists
mxtoolbox mail header
Email headers are present on every email you receive via the Internet and can provide valuable diagnostic information like hop delays, anti-spam results and more. If you need help getting copies of your email headers
In 2 lists
uncoder
An online translator for SIEM saved searches, filters, queries, API requests, correlation and Sigma rules
In 2 lists
DeHashed
DeHashed helps prevent ATO with our extensive data set & breach notification solution. Match employee and consumer logins against the world’s largest repository of aggregated publicly available assets leaked from third-party breaches. Secure passwords before criminals can abuse stolen information,…
In 5 listsDetails
General
MITRE Datasources
Data source objects added to MITRE ATT&CK as part of v10.
In 2 lists
LOTS
Cataloging how cyber attackers abuse legitimate platforms like GitHub or Google Docs to host malware, C2, or exfiltrate data
In 2 lists
loldrivers
Open-source project that brings together vulnerable, malicious, and known malicious Windows drivers
In 2 lists
WTFBIN
Catalogue benign applications that exhibit suspicious behavior. These binaries can emit noise and false positives in threat hunting and automated detections
In 2 lists
Splunk Rules
and Analytic stories
In 2 lists
Elastic Rules
Elastic's detection rules written natively for the Elastic SIEM. Can easily be converted for use by other SIEMs using Uncoder.
In 3 lists
KQL Hunting Queries
A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps.
In 2 lists
LOLOLFarm
A collection of resources for thriving off the land.
In 2 lists
General
Cisco Talos
The threat intelligence organization at the center of the Cisco Security portfolio
In 4 listsDetails
In 2 lists
Detection engineering weekly
A newsletter dedicated to news and how-tos for Detection Engineering.
In 3 lists
DFIR weekly news
A weekly roundup of digital forensics and incident response news.
In 2 lists
krebsonsecurity feed
Investigative reporting on cybercrime, breaches, and threat actors.
In 2 lists
In 2 lists
tl;dr sec newsletter
. A weekly distillation of the best security tools, blog posts, and conference talks, covering AppSec, cloud and container security, DevSecOps, and more.
In 3 lists
General
Exploitation - Defcon Talks
+ https://media.defcon.org/
In 3 lists
General
darknetdiaries
Description: Darknet Diaries explores true stories from the dark side of the Internet. Go behind the hack and hear stories from the "cyber" front lines. Whether you're just curious how hacks happen or are a seasoned Infosec pro, you'll learn something new in an entertaining format.; Host: Jack…
In 4 lists
risky.biz
by Patrick Gray
In 2 lists
Internet Storm Center sans podcast
Description: Stormcasts are daily 5-10 minute information security threat updates.; Host: Dr. Johannes Ullrich @johullrich; Frequency: Daily; Runtime: Regularly 5 mins
In 2 lists
General
General
HackTheBox
OSINT challenges in CTF format.
In 3 lists
Pentestlab
PentesterLab - Hands on labs to understand and exploit simple and advanced web vulnerabilities.
In 7 listsDetails
Root-Me
Hundreds of challenges are available to train yourself in different and not simulated environments
In 6 listsDetails
General
The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory
Detecting Malware and Threats in Windows, Linux, and Mac Memory.
In 2 lists
Applied Incident Response
Steve Anson's book on Incident Response.
In 2 lists
Crafting the InfoSec Playbook: Security Monitoring and Incident
by Jeff Bollinger, Brandon Enright and Matthew Valites.
In 2 lists
PTFM: Purple Team Field Manual
+ PTFM: Purple Team Field Manual v2
Linux insides
A book-in-progress about the Linux kernel and its insides.
In 4 lists
General
lists - aboutdfir.com
Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges and more
In 2 lists
Exploitation - PayloadsAllTheThings
An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares.
In 12 listsDetails
In 2 lists
Linux - EBPF docs
Providing technical documentation for eBPF.
In 2 lists
Logs - Microsoft Defender for Cloud Alert References
A list of all Azure Security for Cloud Alerts, their descriptions, and associated data sources.
In 2 lists
Logs - Microsoft Defender XDR Schemas
To help with multi-table queries, you can use the advanced hunting schema, which includes tables and columns with event information and details about devices, alerts, identities, and other entity types.
In 2 lists
In 2 lists
In 2 lists
SOC - explain shell command arguments
this site will help you quickly understand terminal commands-lines from articles, manuals, and tutorials
In 6 listsDetails
General
LAB automation - Azure - AzureGoat
A Damn Vulnerable Azure Infrastructure
In 2 lists
In 2 lists
SandBox - cuckoo
Cuckoo Sandbox is an automated dynamic malware analysis system.
In 3 lists
SandBox - CAPEv2
eyes:; Rules from various authors bundled with the Config And Payload Extraction Cuckoo Sandbox extension (see next section).
In 3 lists
SandBox - Malice (Virustotal self hosted clone)
Massively scalable malware analysis framework.
In 2 lists
Detection platform - wazuh
Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of monitoring file system changes, system calls and inventory changes.
In 7 listsDetails
Deployment - ansible
Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy. Avoid writing scripts or custom code to deploy and update your applications — automate in a language that approaches plain English, using SSH, with no agents to install on remote systems.
In 11 listsDetails
Network Logs - maltrail
A malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails and featuring an reporting and analysis interface.
In 5 listsDetails
LInux Logs - ossec
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
In 6 listsDetails
Linux Logs - ecapture (SSL/TLS)
Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
In 3 lists
Linux Logs - tracee
A runtime security and forensics tool for Linux which uses eBPF technology to trace the system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns.
In 5 listsDetails
CTI - OpenCTI
Open cyber threat intelligence platform.
In 3 lists
CTI - MISP
Threat intelligence platform including indicators, threat intelligence, malware samples and binaries. Includes support for sharing, generating, and validating YARA signatures.
In 3 lists
IR platform - iris-web
IRIS is a web collaborative platform for incident response analysts allowing to share investigations at a technical level.
In 3 lists
IR platform - FIR
Cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents and is useful for CSIRTs, CERTs and SOCs alike.
In 5 listsDetails
Log samples - Splunk Attack range
A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk.
In 2 lists
IT - Remote connections manager - xpipe
Access your entire server infrastructure from your local desktop
In 2 lists
Endpoint Security - Linux Hardening - lynis
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional..
In 4 lists
General
chmod calculator
Calculate the octal numeric or symbolic value for a set of file or folder permissions in #Linux servers. Check the desired boxes or directly enter a valid numeric value to see its value in other format
In 2 lists
10 minute mail
Disposable mail for 10 min.
In 2 lists
General
Related lists in Security
See category94
Awesome-Selfhosted
awesome-selfhosted/awesome-selfhosted
A list of Free Software network services and web applications which can be hosted on your own servers
91
Awesome Hacker Search Engines
edoardottt/awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
91
Awesome Privacy
lissy93/awesome-privacy
🦄 A curated list of privacy & security-focused software and services
89
Awesome Bug Bounty Tools
vavkamil/awesome-bugbounty-tools
A curated list of various bug bounty tools
88
android-security-awesome
ashishb/android-security-awesome
A collection of android security related resources
87
Awesome Web Security
qazbnm456/awesome-web-security
🐶 A curated list of Web Security materials and resources.