A Python 3.14+ CLI tool (stdlib only) for detecting malware in packages from the Arch User Repository. It scans currently installed AUR packages, historical pacman logs, systemd services, eBPF rootkit artifacts, and npm/bun/yarn/pnpm caches against configurable campaign-based threat lists (e.g., the June 2026 atomic-lockfile attack, CHAOS RAT 2025, Russian spam campaigns). The architecture is modular: campaign configuration is data-driven (JSON), the scanner is split into focused mixin classes (PackageMixin, SystemMixin, CacheMixin) combined via the AurScanner class, and all results are typed dataclasses. The package runs with zero external dependencies, has comprehensive unit tests, and includes an integration layer (pacman hook + systemd timer) for continuous monitoring. The code demonstrates high craftsmanship: strict typing, defensive I/O, locale-safe date parsing, cache-efficient file scanning, and a clean exit-code scheme based on Nagios conventions.
Vigil is an open-source AI SOC (Security Operations Center) platform that orchestrates autonomous threat hunting, incident response, and case management through a multi-agent architecture. The system ingests security findings from SIEMs (Splunk, Elastic, Azure Sentinel), EDRs (CrowdStrike, Microsoft Defender), and other sources via Kafka or webhooks, then uses LLM-driven agents (hunt, root_cause, adjudicate, investigate, compose, chat) to analyze, enrich, and respond. A TypeScript agent layer with event-sourced ledgers and budget enforcement runs investigations, while a Python daemon handles polling, deduplication, and orchestration. The platform exposes its own tools via MCP (Model Context Protocol) and integrates with 30+ external security tools through a descriptor-based plugin system. The frontend is a React SPA with a setup wizard, dashboards, and case management UI. Deployment is via Docker Compose or Helm, with PostgreSQL, Redis, and optional Kafka as backing services.
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
Yeti is a threat intelligence platform that ingests, enriches, correlates, and stores cyber threat observables, entities, indicators (YARA, Sigma, Suricata, regex, forensic artifacts), and DFIQ investigative questions. It provides a FastAPI-based REST API for CRUD operations, graph traversal, semantic search (via ChromaDB), and RBAC. The system uses ArangoDB as its primary graph/document database, Redis for message brokering, and Celery for background task scheduling. It includes a plugin architecture for feeds (30+ public sources like MITRE ATT&CK, CISA KEV, MISP, AbuseIPDB) and analytics (Shodan, Censys, VirusTotal, etc.). The codebase is well-structured with clean abstractions (ArangoYetiConnector, event system, polymorphic schemas, migration framework) but contains deprecated plugins and some configuration drift. It is primarily an application, not a data research project.
This repository is a community-driven threat hunting and detection engineering knowledge base rather than a deployable application. It contains 26+ Windows-focused Jupyter notebooks (authored as Jupytext Markdown) that each follow a strict hypothesis-driven methodology: hypothesis, technical context, offensive tradecraft, pre-recorded security datasets, SQL/Pandas analytics, and Sigma rule output. The repo also includes deep Windows internals documentation, MITRE ATT&CK group profiles (CTI), pre-hunt data management guidance, and a small YARA signature set. The dominant character is data_research: the core artifacts are analytical notebooks, structured metadata, and threat intelligence data, with a hybrid component of Python build scripts that generate the Jupyter Book, table of contents, ATT&CK Navigator layers, and evaluation reports.
Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.
openSquat is a CLI tool for detecting domain squatting threats including phishing, typosquatting, IDN homograph attacks, doppelgänger domains, and bitsquatting. It operates in three modes: Community (free NRD feed), Premium Feed (paid NRD feed with local Levenshtein detection), and Premium API (server-side lookalike API queries). The tool processes keywords against domain feeds using optimized Levenshtein distance with early exit, integrates with VirusTotal, Quad9 DNS, Certificate Transparency, and phishing databases, and outputs results in TXT, JSON, or CSV formats. Architecture features modular components for feed management, DNS validation, squatting detection, API client, and output handling, with parallel processing for performance.
OSINT Brazuca Regex is a CLI tool and curated dataset of regular expressions for detecting Brazilian and global PII/OSINT-relevant patterns. The scanner (`osint_regex_scan.py`) applies the dataset to files, directories, or stdin, supporting multi-threading, text extraction from documents (PDF, DOCX, XLSX, RTF, EPUB) via stdlib or optional `pypdf`/`pdftotext`, and noise filtering (blob masking, line length limits). Output formats include terminal, CSV, JSON, or raw values. The dataset is split into two JSON files (Brazil-specific and general), merged at load time, and includes patterns for CPF, CNPJ, credit cards, crypto wallets, API credentials, and more. The repository also includes a build script (`build.py`) for managing the split/merged dataset. Core functionality requires only Python 3.12+ stdlib, with optional dependencies for extended PDF support and encoding detection.
This repository is the infrastructure-as-code backbone for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It contains over 1,700 files of SaltStack states, Jinja templates, shell scripts, and Python modules that orchestrate the deployment, configuration, and lifecycle management of a distributed grid of security monitoring nodes. The code manages the entire Elastic Stack (Elasticsearch, Logstash, Kibana), network sensors (Zeek, Suricata), file analysis (Strelka), endpoint monitoring (Elastic Fleet/Agent), authentication (Kratos/Hydra), messaging (Kafka/Redis), metrics (Telegraf/InfluxDB), and the Security Onion Console (SOC) web UI. It is not a standalone application but a deployment and configuration system that transforms a bare OS into a fully operational security operations center. The repository is actively maintained with frequent commits, versioned releases, and a large community. Key architecture patterns include role-based state inclusion via `allowed_states`, consistent Docker container management, Jinja-based configuration merging, and event-driven reactors for rule pushes. Notable reusable components include a self-contained threat intelligence analyzer framework, a YAML manipulation CLI tool, and polling-based beacons that avoid inotify leaks.
This repository is a curated 'awesome list' of threat detection and hunting resources. It does not contain any executable code, application logic, or data pipelines. The content is purely a markdown document (README.md) and its HTML equivalent, along with a small number of PDF guides. The repository functions as an index of links to external tools (e.g., osquery, Sigma, HELK), datasets (e.g., Mordor, BOTS), frameworks (MITRE ATT&CK), blogs, videos, and training resources. It is a static, non-functional reference directory. While it serves as a valuable starting point for security professionals, it has no software architecture, no entry points, no data flows, and no reusable code components. Its value lies in curation and organization rather than engineering.
BeaKer is a self-contained threat-hunting deployment for Windows network beacon detection. It provisions an Elasticsearch/Kibana backend with Docker Compose, configures Windows endpoints via a PowerShell agent installer, and ships prebuilt index templates, ingest pipelines, and Kibana dashboards for Sysmon event data. The dominant character is an application/infrastructure project: the core artifacts are deployment scripts, Ansible playbooks, and ELK configuration rather than a library or data analysis framework. A secondary data-pipeline nature is visible in the Elasticsearch ingest pipelines that normalize Windows Security/PowerShell/Sysmon events into ECS, and in the export/import tooling for dashboards and indices.
This repository is a curated list (awesome list) of resources related to malware persistence techniques, tools, and references across multiple platforms (Windows, Linux, macOS, Cloud, Firmware, Databases). It does not contain any executable code, application logic, or data pipelines; it is purely a collection of external links and descriptions organized into categories such as Techniques, Persistence Removal, Detection Testing, Prevention, and Collection. The repository is maintained under the 'awesome' standard with a CI workflow that runs awesome-lint to ensure formatting compliance. It serves as a reference knowledge base for cybersecurity professionals researching persistence mechanisms.