- 📋 Lists: https://github.com/mthcht/awesome-lists/tree/main/Lists
- 🕵️♂️ ThreatHunting Guides: https://mthcht.medium.com/list/threat-hunting-708624e9266f
- 📚 Hijacklibs: https://github.com/mthcht/awesome-lists/tree/main/Hijacklibs
- 🚰 Suspicious Named pipes: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_named_pipe_list.csv
- 🔧 Suspicious Windows Services: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_services_names_list.csv
- ⏲️ Suspicious Windows Tasks: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv
- 🚪 Suspicious destination port: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_ports_list.csv
- 🛡️ Suspicious Firewall rules: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_firewall_rules_list.csv
- 🆔 Suspicious User-agent: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv
- 📇 Suspicious USB Ids: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_usb_ids_list.csv
- 🔢 Suspicious MAC address: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_mac_address_list.csv
- 📛 Suspicious Hostname: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_hostnames_list.csv
- 🧮 Metadata Executables: https://github.com/mthcht/awesome-lists/blob/main/Lists/executables_metadata_informations_list.csv
- 🕸️ DNS over HTTPS server list: https://github.com/mthcht/awesome-lists/blob/main/Lists/dns_over_https_servers_list.csv
- 🌐 TOR Nodes List: https://github.com/mthcht/awesome-lists/tree/main/Lists/TOR
- 🛠️ LOLDriver List: https://github.com/mthcht/awesome-lists/blob/main/Lists/loldrivers_list.csv
- 📜 Malicious SSL Certificates: https://github.com/mthcht/awesome-lists/blob/main/Lists/ssl_certificates_malicious_list.csv
I regularly update most of them after each tool i analyze in my detection keywords project
- ABUSE.CH BLACKLISTS
- Block Lists
- DNS Block List
- Phishing Block List
- C2IntelFeeds
- Volexity TI
- Open Source TI
- C2 Tracker
- Unit42 IOC
- ThreatFOX IOC
- Virustotal
- SpamHaus
- AbuseIPDB
- Malwarebazaar
- emailrep
- cloudfare scan
- shodan
- Onyphe
- Censys
- threatminer
- urlscan
- Apptotal (apps and extensions analysis)
- urlquery
- cloudfare scanner
- urlvoid
- checkphish
- ipvoid
- mxtoolbox
- Microsoft TI
- pulsedive
- threatbook
- McAfee Threat Intelligence Exchange
- Kaspersky Security Network
- Microsoft Security Intelligence Report
- IBM X-Force Exchange
- AlienVault OTX
- greynoise
- jsoncrack
- cyberchef
- Hash calculator
- regex101
- CyberChef
- Javascript Deobfuscator
- JSONViewer
- TextMechanic
- UrlEncode.org
- TextFixer
- RegExr
- TextUtils
- TextCompactor
- Pretty Diff
- XML Tree
- Online XML Formatter and Beautifier
- XML Escape Tool
- DiffChecker
- CSVJSON
- HTML Formatter
- Text Tool
- String Manipulation Tool
- unshorten it
- urlunscrambler
- longurl
- Message Header
- MXToolbox EmailHeaders
- Email Header Analyzer
- Email Header Analysis
- Gitlab dashboard from Excel
- OPENAI
- uncoder
- MITRE techniques
- MITRE Updates
- MITRE D3fend
- MITRE Navigator
- MITRE Datasources
- GTFOBIN
- LOLBAS
- LOTS
- loldrivers
- WTFBIN
- Sigma
- Splunk Rules
- Elastic Rules
- DFIR-Report Sigma-Rules
- JoeSecurity Sigma-Rules
- mdecrevoisier Sigma-Rules
- P4T12ICK Sigma-Rules
- tsale Sigma-Rules
- list of detections resources
- detection engineering resources
- CERT-FR
- CERT FR Alerts
- CERT FR Avis
- NIST CVEs
- JPCERT
- CISA news
- thedfirreport Feed
- Splunk Research Blog
- Unit42 Feed
- DFIR weekly sumary - thisweekin4n6
- akamai Feed
- Elastic Blog
- Checkpoint research Feed
- Cisco Talos Feed
- Crowdstrike Feed
- Hexacorn Blog
- simone kraus Blog
- Michael Haag Blog
- EricaZelic Blog
- Adam Chester Blog Feed
- Mauricio Velazco Blog
- Clément Notin Feed
- tenable Blog
- horizon3 Feed
- Incidents reports Feed
- NCC Group Research Feed
- SpecterOps Feed
- Redcanary Feed
- Sophos Research Feed
- virusbulletin
- Offensive Research - DSAS by INJECT
- HackerNews Feed
- Bleepingcomputer Feed
- detect.fyi
- @inversecos - APT Emulation Labs: xintra
- 13cubed - Investigating Windows Endpoints: 13cubed.com
- @0gtweet - Forensic course: Mastering Windows Forensics
- SANS: SANS508
- Defensive-security: Linux-live-forensics
- @TheDFIRReport : LABs with logs from the existing reports dfir-labs
