IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare - ZephrFish/OmniProx

Full AD attack chain: Kerberoasting, AS-REP Roasting, Pass-the-Hash, DCSync, BloodHound - detected via Splunk SIEM + Windows Event IDs. Detection gap analysis included. - DurgaRamireddy/Active-Dire...

A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts. - MrM8BRH/Defensive-Security-Hub

Contribute to mattp8638/BlueTeam development by creating an account on GitHub.

Sigma detections for real ATT&CK techniques, with a compiler that emits Wazuh, Splunk and Sentinel from one source. 36 rules, 33 techniques, MIT. - zshguy/tyrian-detection-pack

Built a Docker-based Wazuh SIEM environment with Wazuh Manager and Agent to detect SSH brute-force attacks, developed a custom detection rule and automated mitigation using Fail2Ban. - nishkab36/wa...

Open source HIDS tailored for Microsoft Windows and Active Directory - Saeros-Security/Saeros

A forensic visualization tool for Wazuh that transforms Windows process creation logs (Event ID 4688) into interactive, draggable relationship graphs. Optimized for Threat Hunting and Incident Resp...

Your go-to repo for all things cyber. Contribute to luke-mckeever/Cyber_Vault development by creating an account on GitHub.

Automated Wazuh Threat Intelligence Playbook using n8n, VirusTotal, AbuseIPDB, GeoIP, and Telegram for SOC automation. - ashwanth-saran/wazuh-network-threat-intelligence-playbook

SOC investigation of a suspected lateral movement attack using Sysmon, Windows Event Logs, Elastic SIEM, and MITRE ATT&CK to analyze Living-off-the-Land (LotL) activity and reconstruct the ...

Scan RMM-managed software endpoints for vulnerabilities using NIST NVD, CISA KEV, and EPSS data with this agentless PowerShell script. - Staffardprobable495/fleet-cve-scanner

Simple Imager has been created for performing live acquisition of Windows based systems in a forensically sound manner - QXJ6YW4/SimpleImager

Self-hosted threat-intelligence desk for cyber defense teams. - ryanshrier/blueteam

Tools and Techniques for Blue Team / Incident Response - A-poc/BlueTeam-Tools

Contribute to PvT2005/BlueTeam-Challenge-Writeups development by creating an account on GitHub.

A PowerShell script for rapid initial incident response data collection on a potentially breached Windows system. - fulco/BlueWindowsTriage

Local LAN-multiplayer + solo-with-AI table for Backdoors & Breaches (incident-response card game). Node + WebSockets, hidden GM objectives, Ollama narrator. - xD4O/bnb-table

Documentation of my 3-month Cyberster Blue Team internship — covering SOC operations, SIEM lab setup (VirtualBox, Wazuh), network traffic analysis, detection rules, and incident response, building ...

Purple-team threat modeling in the browser. Zero dependencies. One HTML file. Offense and defense on one canvas. - BenjiTrapp/PurpleSkjaldborg