Hacking Tools
Section: Threat Hunting · Meta-list of detection and hunting resources including tools, papers, presentations, blogs, and datasets, serving as a starting point for discovering additional hunting resources.
FreshScore 91
Entry
Awesome Threat Detection
Appears in 2 awesome lists
Meta-list of detection and hunting resources including tools, papers, presentations, blogs, and datasets, serving as a starting point for discovering additional hunting resources.
Found in these lists
Security lists for SOC/DFIR detections
Section: General
FreshScore 85
Often listed next to it
Zeek
(formerly Bro) is an open source software platform that provides compact, high-fidelity transaction logs, file content, and fully customized output to analysts, from the smallest home office to the largest, fastest research and commercial networks. From the FAQ: "Zeek provides a comprehensive…
In 7 listsDetails
GRR Rapid Response
Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, PowerGRR provides an API client library in…
In 7 listsDetails
Velociraptor
Digital forensics and incident response platform that doubles as a powerful endpoint threat-hunting tool, with a specialized query language for interrogating host state, remote forensic collection across fleets, and a notebook environment for collaborative investigation workflows.
In 6 listsDetails
Sigma
Generic signature format for SIEM systems that has become the practical standard for vendor-agnostic detection rules, enabling threat hunters to describe relevant log events in a portable format convertible to platform-specific queries.
In 6 listsDetails
awesome-detection-engineering
Design, build, and operate detective cybersecurity controls.
In 2 listsDetails
HELK
All-in-one free threat hunting stack built on Elasticsearch, Logstash, Kafka, and Kibana with Jupyter Notebook integrations, designed by Roberto Rodriguez (Cyb3rWard0g) as a security data science suite for practicing hunting with pre-loaded attack datasets.
In 5 listsDetails
Wazuh
Open-source security platform that unifies SIEM and XDR capabilities, providing log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and incident response across endpoints and cloud workloads. Recognized as Best SIEM of 2023 by SC Awards and widely adopted by…
In 4 listsDetails
ThreatHunter-Playbook
Collection of hunting playbooks organized by MITRE ATT&CK technique, each including hypothesis, required data sources, analytical queries (Spark, Elastic), and sample datasets to validate detection logic before deploying to production.
In 4 listsDetails