Threat Open Source Projects

E-mails, subdomains and names Harvester - OSINT

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.

Defund the Police.

A curated list of Awesome Threat Intelligence resources

Open Cyber Threat Intelligence Platform

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

IntelOwl: manage your Threat Intelligence at scale

APT & CyberCriminal Campaign Collection

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

Various public documents, whitepapers and articles about APT campaigns

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Real-time HTTP Intrusion Detection

Modular and decentralised honeypot

Interface to WhatsApp Messenger

Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS.

Detect Tactics, Techniques & Combat Threats

♾️ Collection and Roadmap for everyone who wants DevSecOps. Hope your DevOps are more safe 😎

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

Collection of quality safety articles. Awesome articles.

Cyber Threat Intelligence Repository expressed in STIX 2.0

Your Everyday Threat Intelligence

A curated list for Awesome Kubernetes Security resources

Microsoft Threat Intelligence Security Tools

APTnotes data

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)

Phishing Domains, urls websites and threats database. We use the PyFunceble testing tool to validate the status of all known Phishing domains and provide stats to reveal how many unique domains used for Phishing are still active.

An open source threat modeling tool from OWASP

Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring, quarantine, and multi-channel alerting

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.

Trust & Safety tools for working together to fight digital harms.

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

CLI tool for open source and threat intelligence

a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities

The Washington Post is compiling a database of every fatal shooting in the United States by a police officer in the line of duty since 2015.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Adversarial Threat Landscape for AI Systems

Actionable analytics designed to combat threats

Real-time, container-based file scanning at enterprise scale

A collection of sources of indicators of compromise.

The openSquat is an open-source tool for detecting domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.

The Correlated CVE Vulnerability And Threat Intelligence Database API

Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

ReversingLabs YARA Rules

Extract and aggregate threat intelligence.

A collection of resources for Threat Hunters

SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS

CRITs - Collaborative Research Into Threats

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

Public Repository of Open Source Tools for Cyber Threat Intelligence Analysts and Researchers

Purple Team Exercise Framework

Draw.io libraries for threat modeling diagrams

A Network Packet Sniffing tool developed in Python 3.

Agile Threat Modeling Toolkit

SIEM Tactics, Techiques, and Procedures

Curiefense is a unified, open source platform protecting cloud native applications.