threathunting 开源项目推荐（86 个）

intelowlproject /IntelOwl

IntelOwl: manage your Threat Intelligence at scale

alexandreborges /malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

mandiant /ThreatPursuit-VM

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

atc-project /atomic-threat-coverage

Actionable analytics designed to combat threats

SlimKQL /Hunting-Queries-Detection-Rules

KQL 查询。Microsoft Defender、Microsoft Sentinel。

darkquasar /AzureHunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

tenzir /tenzir

Tenzir 是面向安全团队的数据管道引擎。

mthcht /ThreatHunting-Keywords

Awesome list of keywords and artifacts for Threat Hunting sessions

GACWR /OpenUBA

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]

alexverboon /MDATP

MDATP

r3nzsec /irflow-timeline

macOS 的 DFIR 时间线分析——基于 SQLite 支持的查看器，适用于 CSV、TSV、XLSX、EVTX、PLASO、$MFT 和 $J 文件，支持 AI 工件、AI 秘密狩猎、进程检查、横向移动跟踪、持久性检测和 VirusTotal 丰富功能。

THORCollective /HEARTH

A community-driven repository for threat hunting ideas, methodologies, and research that serves as a central gathering place for hunters to share knowledge, collaborate on techniques, and advance the field of threat hunting.

Kirtar22 /Litmus_Test

Detecting ATT&CK techniques & tactics for Linux

spmedia /Threat-Actor-Usernames-Scrape

从各种网络犯罪来源和论坛中收集的情报和用户名的集合和列表。DarkForums、HackForums、Patched、Cracked、BreachForums、OGuser、XSS、Dread等

AbdulRhmanAlfaifi /Fennec

Artifact collection tool for *nix systems

mthcht /Purpleteam

Purpleteam scripts simulation & Detection - trigger events for SOC detections

socprime /Uncoder_IO

An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.

DXC-0 /soc-ressources

Repository for SOC analysts, queries to investigate, advanced hunting, sites for analysis, malware samples, courses to improve skills, IOC and monitoring.

Viralmaniar /MurMurHash

This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.

alt3kx /wafaray

Enhance your malware detection with WAF + YARA (WAFARAY)