awesome-lists
Awesome Security lists for SOC/CERT/CTI
https://github.com/mthcht/awesome-lists
Last synced: 12 days ago
JSON representation
Data manipulation
Sandbox
Investigation
More TI
TI
📂 My Detection Lists
My Detection Lists
IOC Feeds/Blacklists:
Other Lists
📚 Books
Books
- SANS FOR500 / FOR508 book
- SANS 555 book
- Practical Forensic Imaging
- Practical-Linux-Forensics-Digital-Investigators
- TheHitchhikersGuidetoDFIRExperiencesFromBeginnersandExperts - Free
- Eric Zimmerman Manual Tools - Free
- The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory
- Applied Incident Response
- Blue Team Handbook: Incident Response Edition
- Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
- Placing the Suspect Behind the Keyboard: DFIR Investigative Mindset
- Crafting the InfoSec Playbook: Security Monitoring and Incident
- Investigating Windows Systems
- Blue Team Handbook: SOC, SIEM, and Threat Hunting
- BTFM: Blue Team Field Manual
- PTFM: Purple Team Field Manual - 2nd-Purple-Field-Manual/dp/1736526790)
- MITRE - 11 Strategies of a World-Class Cybersecurity Operations Center
- Windows Internals Books
- How Linux Works
- Linux Device Drivers
- Understanding The Linux Virtual Memory Manager
- Linux insides
- Linux Ebpf
- Hacking Art Exploitation
- Hacker Playbook Practical Penetration Testing
- RTFM: Red Team Field Manual
- Red Team Development and Operations: A practical guide
- RTRM: Red Team Reference Manual
- EDR - Introduction to endpoint security
- Big picture on running a SOC - Modern SOC
- POC||GTFO
- Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats
Content creation
🧩 Data manipulation
Data manipulation
- jsoncrack
- Hash calculator
- regex101
- Javascript Deobfuscator
- JSONViewer
- TextMechanic
- UrlEncode.org
- TextFixer
- RegExr
- TextUtils
- TextCompactor
- Pretty Diff
- XML Tree
- Online XML Formatter and Beautifier
- XML Escape Tool
- DiffChecker
- HTML Formatter
- Text Tool
- String Manipulation Tool
- urlunscrambler
- longurl
- Message Header
- MXToolbox EmailHeaders
- Email Header Analyzer
- Email Header Analysis
- Gitlab dashboard from Excel
- OPENAI
- uncoder
- DeHashed
- PCAP online analyzer
- JS deobfuscator
- CyberChef
📡 Detection Resources
Detection Resources
- MITRE Updates
- MITRE Datasources
- LOTS
- loldrivers
- WTFBIN
- Sigma
- Splunk Rules
- JoeSecurity Sigma-Rules
- GTFOBIN
- LOLBAS
- Elastic Rules
- DFIR-Report Sigma-Rules
- mdecrevoisier Sigma-Rules
- P4T12ICK Sigma-Rules
- tsale Sigma-Rules
- list of detections resources
- detection engineering resources
- awesome-threat-detection
- LOLRMM
🛡️ DFIR:
- 🔥 EricZimmerman Tools 🔥
- dfir-orc
- Kape
- \[memory\
- Yara - Threat Hunting - Keywords)
- dfir-orc-config
- Splunk4DFIR
- dfiq
- \[EVTX\
- \[EVTX\
- regripper
- RdpCacheStitcher
- Searching strings - ripgrep
- Kape Files
- More Kape ressources
- VolatileDataCollector
- Velociraptor
- \[memory\
- \[memory\
- \[memory\
- \[memory\
- Windows artifacts
- \[Linux\
- \[OS\
- lists - aboutdfir.com
- Mind maps
- arfifacts List - DFIRArtifactMuseum
- arfifacts List - ForensicArtifacts
- Autopsy
- SleuthKit
- \[OS\
- \[OS\
- \[OS\
- \[OS\
- \[OS\
- Yara - Forge
- capa
- Malcontent
- \[Event parser\
- \[Event Parser\
- \[Event Parser\
- \[EVTX\
- \[EVTX / Auditd\
- werejugo
- ADTimeline
- PersistenceSniper
- \[O365\
- Logon Tracer
- Timeline Plaso
- Timeline TimeSketch
- hollows hunter
- PE sieve
- Searching strings - Recoll
- TZ tools
- Nirsoft tools
- \[Image Mount\
- \[Image Mount\
- \[Network\
- \[Network\
- \[Network\
- \[Carving\
- \[Carving\
- Didier Stevens tools
- Monitoring - Osquery
- \[IR Guide\
- Arsenal Recon Forensic tools
- PSBits
- \[OSX Tools\
- usnjrnl_rewind
- OneDrive OCR DB artifact collector exe
- OneDrive OCR DB artifact collector python
- Browser Chrome Extensions DNS Forensic
- srum-dump
- \[memory\
- \[Linux\
DFIR
💬 Discord /Slack channels
- RedTeam - 🔥 Initial Access Guild 🔥 Discord
- RedTeam - 🔥 Red-Team VX community 🔥 Discord
- RedTeam - evilsocket Discord
- RedTeam - OffSec Discord
- Threat Hunting - Threat Hunter community Discord
- PurpleTeam - Ipurpleteam Discord
- Blueteam Detection engineering - Hunter's Den Discord
- Blueteam Detection engineering - Sigma HQ Discord
- Blueteam Threat Intel - Malcore Discord