- ๐ Lists: https://github.com/mthcht/awesome-lists/tree/main/Lists
- ๐ต๏ธโโ๏ธ ThreatHunting Guides: https://mthcht.medium.com/list/threat-hunting-708624e9266f
- ๐ฐ Suspicious Named pipes: suspicious_named_pipe_list.csv
- ๐ Suspicious TLDs (updated automatically): [suspicious_TLDs]
- ๐ Suspicious ASNs (updated automatically): [suspicious ASNs]
- ๐ง Suspicious Windows Services: suspicious_windows_services_names_list.csv
- โฒ๏ธ Suspicious Windows Tasks: suspicious_windows_tasks_list.csv
- ๐ช Suspicious destination port: suspicious_ports_list.csv
- ๐ก๏ธ Suspicious Firewall rules: suspicious_windows_firewall_rules_list.csv
- ๐ Suspicious User-agent: suspicious_http_user_agents_list.csv
- ๐ Suspicious USB Ids: suspicious_usb_ids_list.csv
- ๐ข Suspicious MAC address: suspicious_mac_address_list.csv
- ๐ Suspicious Hostname: suspicious_hostnames_list.csv
- ๐งฎ Metadata Executables: executables_metadata_informations_list.csv
- ๐ธ๏ธ DNS over HTTPS server list: dns_over_https_servers_list.csv
- ๐ Hijacklibs (updated automatically): hijacklibs_list.csv
- ๐ TOR Nodes Lists (updated automatically): [TOR]
- ๐ ๏ธ LOLDriver List (updated automatically): loldrivers_only_hashes_list.csv
- ๐ ๏ธ Malicious Bootloader List (updated automatically): malicious_bootloaders_only_hashes_list.csv
- ๐ Malicious SSL Certificates List (updated automatically): ssl_certificates_malicious_list.csv
- ๐ฅ๏ธ RMM detection: [RMM]
- ๐ค๐ Important Roles and groups for AD/EntraID/AWS: [permissions]
- ๐ป๐ Ransomware known file extensions: ransomware_extensions_list.csv
- ๐ป๐ Ransomware known file name ransom notes: ransomware_notes_list.csv
- ๐ Windows ASR rules: windows_asr_rules.csv
- ๐ DNSTWIST Lists (updated automatically): DNSTWIST Default Domains + script
- ๐ VPN IP address Lists (updated automatically):
- ๐ก๏ธ NordVPN: nordvpn_ips_list.csv
- ๐ก๏ธ ProtonVPN: protonvpn_ip_list.csv
- ๐ข Companies IP Range Lists (updated automatically): Default Lists + script / Microsoft
- ๐ GeoIP services Lists: ip_location_sites_list.csv
- ๐งฌ Yara rules: Threat Hunting yara rules
- ๐งฌ Offensive Tools detection patterns: offensive_tool_keywords.csv
- ๐งฌ Greyware Tools detection patterns: greyware_tool_keyword.csv
- ๐งฌ AV signatures keywords: signature_keyword.csv
- ๐งฌ Microsoft Defender AV signatures lists: [Defender]
- ๐งฌ ClamAV signatures lists: [ClamAV]
- ๐ Others correlation Lists: [Others]
- ๐ Lists i need to finish: [todo]
I regularly update most of these lists after each tool i analyze in my detection keywords project
- ABUSE.CH BLACKLISTS
- Block Lists
- DNS Block List
- Phishing Block List
- C2IntelFeeds
- Volexity TI
- Open Source TI
- C2 Tracker
- Unit42 IOC
- Sekoia IOC
- Unit42 Timely IOC
- Unit42 Articles IOC
- ThreatFOX IOC
- Zscaler ThreatLabz IOC
- Zscaler ThreatLabz Ransomware notes
- experiant.ca
- Sophos lab IOC
- ESET Research IOC
- ExecuteMalware IOC
- Cisco Talos IOC
- Elastic Lab IOC
- Blackorbid APT Report IOC
- AVAST IOC
- DoctorWeb IOC
- BlackLotusLab IOC
- prodaft IOC
- Pr0xylife DarkGate IOC
- Pr0xylife Latrodectus IOC
- Pr0xylife WikiLoader IOC
- Pr0xylife SSLoad IOC
- Pr0xylife Pikabot IOC
- Pr0xylife Matanbuchus IOC
- Pr0xylife QakBot IOC
- Pr0xylife IceID IOC
- Pr0xylife Emotet IOC
- Pr0xylife BumbleBee IOC
- Pr0xylife Gozi IOC
- Pr0xylife NanoCore IOC
- Pr0xylife NetWire IOC
- Pr0xylife AsyncRAT IOC
- Pr0xylife Lokibot IOC
- Pr0xylife RemcosRAT IOC
- Pr0xylife nworm IOC
- Pr0xylife AZORult IOC
- Pr0xylife NetSupportRAT IOC
- Pr0xylife BitRAT IOC
- Pr0xylife BazarLoader IOC
- Pr0xylife SnakeKeylogger IOC
- Pr0xylife njRat IOC
- Pr0xylife Vidar IOC
- Pr0xylife Warmcookie IOC
- Cloud Intel IOC
- SpamHaus drop.txt
- UrlHaus_misp
- UrlHaus
- vx-underground - Great Resource for Samples and Intelligence Reports
More github lists: https://github.com/mthcht?tab=stars&user_lists_direction=asc&user_lists_sort=name
- Tools used by ransomware groups - @BushidoToken
- Techniques - MITRE ATT&CK
- Tactics - MITRE ATT&CK
- Mitigation - MITRE ATT&CK
- ATT&CK matrix navigator
- All MITRE data in xlsx format
- Tools used by threat actor groups - MITRE ATT&CK
- atomic-red-team
- redcanary Threat Detection report
- The-Unified-Kill-Chain
- TTP pyramid
- Pyramid of pain
- Cyber Kill chain
- MITRE D3FEND
- MITRE CAPEC
- MITRE CAR
- MITRE PRE-ATT&CK Techniques
- Ransomware.live
- jsoncrack
- JS deobfuscator
- cyberchef
- PCAP online analyzer
- Hash calculator
- regex101
- CyberChef
- Javascript Deobfuscator
- JSONViewer
- TextMechanic
- UrlEncode.org
- TextFixer
- RegExr
- TextUtils
- TextCompactor
- Pretty Diff
- XML Tree
- Online XML Formatter and Beautifier
- XML Escape Tool
- DiffChecker
- CSVJSON
- HTML Formatter
- Text Tool
- String Manipulation Tool
- unshorten it
- urlunscrambler
- longurl
- Message Header
- MXToolbox EmailHeaders
- Email Header Analyzer
- Email Header Analysis
- Gitlab dashboard from Excel
- OPENAI
- uncoder
- DeHashed
- MITRE techniques
- MITRE Updates
- MITRE D3fend
- MITRE Navigator
- MITRE Datasources
- GTFOBIN
- LOLBAS
- LOTS
- loldrivers
- WTFBIN
- Sigma
- Splunk Rules
- Elastic Rules
- DFIR-Report Sigma-Rules
- JoeSecurity Sigma-Rules
- mdecrevoisier Sigma-Rules
- P4T12ICK Sigma-Rules
- tsale Sigma-Rules
- list of detections resources
- detection engineering resources
- awesome-threat-detection
- CERT-FR
- CERT FR Alerts
- CERT FR Avis
- NIST CVEs
- JPCERT
- CISA news
- thedfirreport Feed
- Splunk Research Blog
- Unit42 Feed
- DFIR weekly sumary - thisweekin4n6
- Google Threat Intelligence
- Sekoi Blog
- akamai Feed
- Elastic Blog
- Checkpoint research Feed
- Cisco Talos Feed
- Crowdstrike Feed
- Hexacorn Blog
- simone kraus Blog
- Michael Haag Blog
- EricaZelic Blog
- Adam Chester Blog Feed
- Mauricio Velazco Blog
- Clรฉment Notin Feed
- tenable Blog
- horizon3 Feed
- Incidents reports Feed
- NCC Group Research Feed
- SpecterOps Feed
- Redcanary Feed
- Sophos Research Feed
- virusbulletin
- Offensive Research - DSAS by INJECT
- HackerNews Feed
- Bleepingcomputer Feed
- detect.fyi
- DFIR Podcasts
- DFIR weekly news
- sans blog
- @inversecos - APT Emulation Labs: xintra
- 13cubed - Investigating Windows Endpoints: 13cubed.com
- @0gtweet - Forensic course: Mastering Windows Forensics
- SANS: SANS508
- Defensive-security: Linux-live-forensics
- @TheDFIRReport : LABs with logs from the existing reports dfir-labs
- @DebugPrivilege : Forensic Debugging free course InsightEngineering
- @ACEresponder: Courses with Detailed Explanations and Labs aceresponder.com
- @binaryz0ne: DFIR challenges with Datasets
- tryhackme - SOC lvl1
- letsdefend.io @chrissanders88 - letsdefend.io
- SANS: SANS555
- Splunk Boss Of The SOC - BOTS
- BOTS dataset v1
- BOTS dataset v2
- BOTS dataset v3