Advanced Network Reconnaissance, Enum & Vulnerability Discovery Framework : A blazing-fast, comprehensive reconnaissance tool built in Go for modern security professionals. - MrEchoFi/Bann...

IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare - ZephrFish/OmniProx

A hands-on SSH honeypot lab using Cowrie to simulate attacker activity, capture commands, and analyze session logs. - bigcnash/cowrie-ssh-honeypot

Full AD attack chain: Kerberoasting, AS-REP Roasting, Pass-the-Hash, DCSync, BloodHound - detected via Splunk SIEM + Windows Event IDs. Detection gap analysis included. - DurgaRamireddy/Active-Dire...

A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts. - MrM8BRH/Defensive-Security-Hub

Contribute to mattp8638/BlueTeam development by creating an account on GitHub.

Sigma detections for real ATT&CK techniques, with a compiler that emits Wazuh, Splunk and Sentinel from one source. 36 rules, 33 techniques, MIT. - zshguy/tyrian-detection-pack

Built a Docker-based Wazuh SIEM environment with Wazuh Manager and Agent to detect SSH brute-force attacks, developed a custom detection rule and automated mitigation using Fail2Ban. - nishkab36/wa...

Open source HIDS tailored for Microsoft Windows and Active Directory - Saeros-Security/Saeros

Collecting IOCs posted on Twitter. Contribute to jaguarmayan8/TwitterIoCsfeed development by creating an account on GitHub.

A forensic visualization tool for Wazuh that transforms Windows process creation logs (Event ID 4688) into interactive, draggable relationship graphs. Optimized for Threat Hunting and Incident Resp...

Home lab for SOC Analyst training. Includes detection rules, playbooks and alert analysis. - Davidking100/SOC-BlueTeam-Lab

Your go-to repo for all things cyber. Contribute to luke-mckeever/Cyber_Vault development by creating an account on GitHub.

Automated Wazuh Threat Intelligence Playbook using n8n, VirusTotal, AbuseIPDB, GeoIP, and Telegram for SOC automation. - ashwanth-saran/wazuh-network-threat-intelligence-playbook

SOC investigation of a suspected lateral movement attack using Sysmon, Windows Event Logs, Elastic SIEM, and MITRE ATT&CK to analyze Living-off-the-Land (LotL) activity and reconstruct the ...

Scan RMM-managed software endpoints for vulnerabilities using NIST NVD, CISA KEV, and EPSS data with this agentless PowerShell script. - Staffardprobable495/fleet-cve-scanner

Linux & security fundamentals demonstrated through the OverTheWire Bandit wargame skills-mapped, spoiler-free. - WiLL75G/overthewire-bandit-skills

Detection Rule / Sigma Rule Writing. Contribute to huzaifa847/BlueTeam-Week2 development by creating an account on GitHub.

Simple Imager has been created for performing live acquisition of Windows based systems in a forensically sound manner - QXJ6YW4/SimpleImager

Self-hosted threat-intelligence desk for cyber defense teams. - ryanshrier/blueteam