Tools

Full-packet-capture indexing and search system (formerly Moloch) — captures and stores traffic at scale, then lets analysts search and pull sessions back out by any field, PCAP included.

Red Canary's library of small, individually-executable tests mapped one-to-one to ATT&CK techniques — run a single atomic test and check whether the expected alert fired, instead of a full adversary-emulation exercise.

Invoke-AtomicTest T1003.001

Sysinternals tool enumerating every autostart location on Windows (run keys, services, scheduled tasks, WMI, browser helper objects…) — the fastest way to spot a persistence mechanism.

autorunsc.exe -accepteula -a * -c -h -s > autoruns.csv

Diffing enabled units against a known-good baseline is a fast way to spot a persistence unit an attacker added, without waiting for full artifact collection.

systemctl list-unit-files --state=enabled | sort > current_units.txt
diff baseline_units.txt current_units.txt

Bluetooth (Classic + BLE) device discovery service that logs and fingerprints everything it sees over time, aimed at long-running physical-security/asset-tracking style monitoring.

sudo blue_hydra

Thinkst's free trip-wire generator — produces tokens (a fake AWS key, a Word doc, a URL, a DNS name) that silently phone home the moment someone opens or uses them, turning "did anyone touch this?" into an instant alert.

An automated malware analysis sandbox descended from Cuckoo, focused on Configuration And Payload Extraction — it unpacks and extracts C2 configs from common malware families rather than just logging behaviour.

Bridgecrew/Palo Alto's static analysis scanner for infrastructure-as-code — flags insecure defaults in Terraform, CloudFormation, Kubernetes manifests, ARM and Dockerfiles before they're deployed.

checkov -d ./terraform

The US government's list of CVEs confirmed to be actively exploited in the wild, used to prioritise patching over raw CVSS score alone.

Open-source static vulnerability analysis for container images — the scanner behind Quay.io, indexes image layers and matches against multiple CVE feeds.

Capital One's rules engine for cloud governance — YAML policies describe the compliant state you want, and it can report, alert or automatically remediate drift across AWS/Azure/GCP.

custodian run -s output/ policy.yml

Microsoft's serverless tool for running attack simulation scenarios in Azure — executes ATT&CK-mapped techniques to validate that detections and alerts fire as expected.

Identifies violations of least privilege in AWS IAM policies (e.g. privilege escalation, resource exposure, data exfiltration paths) and produces a browsable risk report.

cloudsplaining download\ncloudsplaining scan --input-file default.json

Cloud configuration scanner (now part of Aqua) for AWS/Azure/GCP/OCI — detects common misconfigurations across dozens of services with a plugin-based check engine.

TheHive project's observable-analysis engine — runs analyzers (VirusTotal, abuse.ch, MISP, sandbox lookups, etc.) against IOCs on demand or from a case.

A medium-interaction SSH and Telnet honeypot — logs brute-force attempts and full attacker shell sessions, and can fake a filesystem convincingly enough to capture what a bot or human does after it "gets in".

A crowdsourced, behaviour-based intrusion detection and prevention engine — parses local logs for attack patterns and shares/consumes IP reputation with a global community, so one deployment benefits from every other one.

cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual ban"

A Vagrant/Packer-built lab that stands up a small Windows Active Directory environment pre-wired with Splunk, Sysmon and Windows Event Forwarding — a ready-made range for practicing detection engineering and threat hunting.

Rabobank's toolset for scoring data source visibility, detection coverage and threat-actor relevance against the MITRE ATT&CK matrix, to prioritise where to build detections next.

Generates and checks likely typosquatted, homoglyph and bit-flipped variations of a domain name — the standard tool for detecting phishing/brand-impersonation domains registered against a company before a takedown is needed.

dnstwist --registered example.com

Visualises and diagnoses a domain's DNS and DNSSEC delegation chain — spots misconfigurations that would otherwise show up only as intermittent, hard-to-explain resolution failures.

Checks a Docker host and its running containers against the CIS Docker Benchmark — a fast, scripted way to see how far a host configuration is from the recommended baseline.

docker run --rm --net host --pid host --cap-add audit_control -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro docker/docker-bench-security

Quick manual persistence check across the four most commonly abused Run/RunOnce keys, without needing Autoruns installed on the box.

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"

The SIEM and endpoint-security layer built on the Elastic Stack — detection rules, timeline investigation and case management on top of whatever logs and Elastic Agent/Beats data are already being shipped.

The long-standing log-watching intrusion prevention daemon — matches patterns like repeated failed SSH logins in a log file and reacts by firewalling the offending IP, no agent or cloud dependency required.

fail2ban-client status sshd

A CNCF runtime security tool for containers and Kubernetes — watches kernel syscalls against a rule set to detect unexpected process execution, privilege escalation and file access inside running workloads.

A dependency-free bash IOC scanner in the same family as Loki — checks hashes, filenames, string matches and suspicious permissions against a simple indicator list, for hosts where nothing heavier can be installed.

./fenrir.sh /path/to/scan

A Windows kernel-level observability and detection tool — captures and filters the raw kernel event stream (process, file, registry, network) with its own filtering expression language, built for host-based threat hunting.

fibratus run kevt.name = 'CreateProcess'

Surfaces 4732/4728 (member added to a security-enabled local/global group) events — the classic signal for privilege escalation via group membership abuse.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4728} |
  Select-Object TimeCreated, Id, @{n='Member';e={$_.Properties[0].Value}}, @{n='Group';e={$_.Properties[2].Value}}

Attacker-planted SUID binaries are a common Linux persistence/privesc trick; this lists every SUID/SGID file so you can eyeball it against a known-good baseline.

find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \; 2>/dev/null

An open-source management layer for osquery — schedules queries, manages the agent fleet and turns raw osquery output into a usable device-inventory and detection tool at organisation scale.

NCC Group's Google Cloud Platform security auditing tool — pulls IAM, network and resource configuration and highlights common GCP misconfigurations.

The Honeynet Project's generic low-interaction honeypot proxy — sits in front of any TCP port, logs every connection and can hand off to protocol-specific honeypots behind it, useful as a catch-all sensor across a whole address range.

A centralised log management platform built on Elasticsearch/OpenSearch and MongoDB — search, dashboards and alerting across every log source pointed at it, a common lighter-weight alternative to a full Elastic SIEM build.

Google's remote live-forensics framework — agents on endpoints answer forensic queries (files, processes, registry, memory) at scale for incident responders who cannot ship a disk image for every host.

Anchore's vulnerability scanner for container images and filesystems — pairs with Syft's SBOMs to give a fast, accurate CVE match against installed packages.

grype myapp:latest

Roberto Rodriguez's advanced hunting platform on the Elastic Stack — adds Spark/Jupyter analytics and graph capability on top of ELK for large-scale hypothesis-driven threat hunting.

Pulls Sysmon Event ID 3 (network connection) entries for a given process image — useful for confirming whether a suspicious binary actually phoned home.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 3 -and $_.Message -match 'powershell.exe' } |
  Select-Object TimeCreated, Message

Greps Sysmon Event ID 1 (process creation) for a suspicious substring in the command line — quick manual hunting when you do not yet have a Sigma rule for it.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 1 -and $_.Message -match 'EncodedCommand' } |
  Select-Object TimeCreated, Message

Targeted collection and parsing of forensic artifacts from a live or imaged Windows system in minutes — pulls only the files that matter (registry hives, event logs, browser history, prefetch) instead of a full disk image.

kape.exe --tsource C: --tdest D:\triage --target !SANS_Triage

Checkmarx's open-source IaC security scanner — thousands of queries across Terraform, Kubernetes, Docker, CloudFormation and more, built on the same query engine as Checkmarx's SAST.

kics scan -p ./infra -o results/

Aqua Security's tool for checking whether Kubernetes is deployed according to the CIS Kubernetes Benchmark — runs as a pod against the cluster's own components.

kube-bench run --targets node,policies

ARMO's Kubernetes security platform — scans manifests, live clusters and container images against NSA/CISA hardening guidance, MITRE ATT&CK for containers and custom frameworks.

kubescape scan framework nsa

WithSecure's framework for testing cloud detection and response by executing ATT&CK-mapped attack techniques against AWS/Azure/GCP, driven by simple YAML test definitions.

SecOps cloud platform built from composable primitives — an EDR-grade sensor, detection & response rules, and log ingestion, priced and built for building your own security stack.

Quick cluster-wide audit for containers that do not need to run privileged or as root but do anyway — a top item on any container hardening review.

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged==true or .spec.securityContext.runAsUser==0) | "\(.metadata.namespace)/\(.metadata.name)"'

Scheduled tasks are one of the most common Windows persistence mechanisms; this lists every task with its creation/last-run time so a recently added one stands out.

Get-ScheduledTask | Get-ScheduledTaskInfo |
  Sort-Object LastRunTime -Descending |
  Select-Object TaskName, LastRunTime, NextRunTime

A service binary path an unprivileged user can overwrite is a classic privilege-escalation and persistence weakness; this narrows the whole service list down to that condition.

Get-WmiObject win32_service | Where-Object { $_.StartName -eq 'LocalSystem' } |
  Select-Object Name, DisplayName, PathName, StartMode

PowerShell module that scans Active Directory Certificate Services (AD CS) for the common ESC1-ESC8-style misconfigurations, and can remediate several of them automatically.

Invoke-Locksmith -Mode 2

Free triage tool that pulls and highlights the Windows Event Log entries and registry/config items that matter most for malicious activity detection and log hardening review.

Florian Roth's free IOC and YARA scanner — walks a filesystem checking file hashes, filenames, YARA signatures and known-bad registry/process indicators against a curated ruleset, for a quick compromise check on a single host.

python loki.py -p C:\

Cloud-native SIEM/SOAR on Azure — Kusto (KQL) analytics rules, hunting queries and playbooks over log data collected from Azure, on-prem and other clouds.

SecurityEvent | where EventID == 4625 | summarize count() by Account, IpAddress | order by count_ desc

Open-source threat intelligence platform — stores, correlates and shares IOCs and events between organisations via a structured, taxonomy-tagged data model.

MITRE's automated adversary emulation platform — runs chained ATT&CK techniques against a target environment on a schedule, so a blue team can verify their detections actually fire rather than assuming they would.

Pre-recorded, ATT&CK-mapped security event datasets (from Roberto Rodriguez's OTR project) for practising detection engineering and hunting without needing your own attack lab.

Open Policy Agent and its Kubernetes admission-controller integration, Gatekeeper — write once, enforce policy-as-code rules that reject non-compliant resources before they are ever created.

opa eval -i input.json -d policy.rego "data.k8s.deny"

Thinkst's lightweight, low-interaction honeypot daemon — fakes a handful of common services (SSH, RDP, SMB, HTTP, a fake MySQL) just convincingly enough to alert the moment anything touches them, with almost no operational overhead.

opencanaryd --start

An open-source threat intelligence platform structured around the STIX2 data model — links indicators, malware, threat actors and campaigns as a knowledge graph rather than a flat feed of IOCs.

Facebook/Meta's endpoint agent that exposes an operating system's state (processes, users, open sockets, installed packages, scheduled tasks) as SQL tables — 'ask the OS a question' via SQL instead of a bespoke agent API.

osqueryi "SELECT pid, name, path FROM processes WHERE on_disk = 0;"

The original open-source host intrusion detection system that Wazuh forked from — log analysis, file integrity monitoring, rootkit detection and active response from a lightweight multi-platform agent.

Open Source Security Events Metadata project — a common data model and documentation for standardising log field meaning across platforms, so detections translate cleanly between tools.

OWASP's collection of concise, defensive "how to actually do this correctly" references (auth, session management, input validation, crypto storage) rather than attack techniques.

Duo Labs' AWS IAM policy linter — checks policy documents for syntax errors and known bad patterns before they get attached to a role.

parliament --file policy.json

Network-wide DNS sinkhole — blocks ads and known-malicious domains at resolution time, and its query log doubles as a lightweight DNS monitoring/visibility tool for a home or small office network.

pihole -q malicious-domain.com   # check if/why a domain is being blocked

Kubernetes cluster sanitizer — scans live resources for misconfigurations, deprecated APIs and potential issues, reporting a per-resource 'score' rather than only security findings.

popeye

Semperis' free Active Directory and Entra ID security assessment tool — checks for dozens of known attack paths and misconfigurations, scored and prioritised for remediation.

Python library implementing the Sigma rule specification and backend pipelines — what sigma-cli and most Sigma tooling is actually built on.

pip install pysigma pysigma-backend-splunk

Pulls recent 4625 (failed logon) events with account and source IP, straight from PowerShell — the first check on a suspected brute-force or password-spray.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 |
  Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='SourceIP';e={$_.Properties[19].Value}} |
  Format-Table -AutoSize

A ready-made osquery query for the classic Windows Run/RunOnce persistence locations — paste it into osqueryi or a scheduled pack.

osqueryi "SELECT * FROM registry WHERE path LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%';"

A real-time log analysis and correlation engine designed to sit alongside Snort/Suricata, applying Snort-like rule syntax to log data so log events and network alerts can be correlated in one place.

sagan -c /usr/local/etc/sagan.yaml

A free Linux distribution for network security monitoring and log management — bundles Zeek, Suricata, Wazuh and a full Elastic-based analyst UI into one deployable platform for a whole SOC stack.

Nonprofit that scans the internet at scale and sends free daily exposure/compromise reports to the network owners who register for them.

Open-source SOAR — drag-and-drop playbooks that pull alerts, enrich IOCs and drive response actions across a SOC toolchain without paying for a commercial SOAR seat.

A generic, SIEM-agnostic signature format for describing log-based detections — write a detection once in Sigma YAML and convert it (via pySigma/sigma-cli) to Splunk, Elastic, QRadar or a dozen other query languages.

sigma convert -t splunk rule.yml

Neo23x0's public collection of YARA rules and IOCs used by Loki/THOR — a solid, actively maintained rule set to drop straight into your own scanner or SIEM.

One of the original open-source network intrusion detection/prevention systems — a huge community rule-set ecosystem built up over more than two decades.

snort -A console -q -c /etc/snort/snort.conf -i eth0

Turbot's tool that exposes cloud provider APIs as SQL tables — write plain SQL to audit AWS/Azure/GCP/Kubernetes/GitHub configuration instead of writing bespoke API scripts.

steampipe query "select name, arn from aws_s3_bucket where not block_public_acls;"

A high-performance open-source network IDS/IPS and network security monitoring engine — multi-threaded, Snort-rule-compatible, with built-in protocol logging.

suricata -i eth0 -c /etc/suricata/suricata.yaml

Anchore's SBOM (Software Bill of Materials) generator for container images and filesystems — the package inventory that Grype and other scanners match CVEs against.

syft myapp:latest -o cyclonedx-json

The widely-adopted, well-commented baseline Sysmon configuration — a sane starting ruleset for logging high-value security events without drowning a SIEM in noise.

sysmon.exe -c sysmonconfig-export.xml

Olaf Hartong's modular Sysmon configuration — swap in only the event categories you need (process creation, network, WMI, DNS…) rather than one giant monolithic config file.

Community-maintained continuation of Process Hacker — deep process, service, network and driver inspection for live Windows triage, including terminating handles that a normal task manager cannot touch.

Deutsche Telekom's all-in-one honeypot platform — bundles Cowrie, Dionaea and a couple dozen other honeypots plus an ELK dashboard into one Docker-composed deployment, for a broad-spectrum sensor rather than a single service.

Replays previously captured pcap traffic back onto a live network at controlled speed — used to test IDS/IPS/SIEM detection rules against known-bad traffic without re-attacking anything.

tcpreplay -i eth0 --mbps=10 malicious.pcap

Static IaC security scanner covering Terraform, Kubernetes, Helm and CloudFormation — policy-as-code rules (OPA-based) catch misconfigurations before they reach production.

terrascan scan -i terraform -d ./infra

Cilium's eBPF-based security observability and runtime enforcement tool — real-time visibility into process execution, file and network activity with the option to block, not just alert.

Scalable, open-source Security Incident Response Platform — cases, tasks, observables and templated playbooks for a SOC/CSIRT team working alerts together.

Nextron Systems' free edition of their commercial THOR APT scanner — a faster, more actively maintained successor to Loki, built to sweep a host for the same class of compromise indicators and YARA hits.

Aqua Security's eBPF-based Linux runtime security and forensics tool — traces syscalls and events with a rules engine for detecting suspicious container/host behaviour live.

tracee --output json

Aqua Security's all-in-one scanner — container images, filesystems, IaC and git repos for known CVEs, secrets and misconfigurations, fast enough to run in every CI pipeline.

trivy image myapp:latest

SOC Prime's free online translator between Sigma, SPL, KQL, EQL, YARA-L and other query languages — paste a Sigma rule, get a ready query for your SIEM.

Checks a website's reputation against multiple blacklist and reputation engines at once, a quick sanity check before visiting an unfamiliar link.

Security Risk Advisors' free platform for tracking purple team exercises — records which attack techniques were run, what was detected, and where a gap needs a new rule.

Endpoint visibility and DFIR platform — a query language (VQL) for hunting across a fleet of endpoints, collecting artifacts and monitoring in near-real-time rather than imaging one box at a time.

velociraptor -v --config server.config.yaml frontend

A free, open-source XDR/SIEM platform — log analysis, file integrity monitoring, vulnerability detection and rootcheck/rootkit detection from a fleet of lightweight agents, built as an OSSEC fork with a modern stack around it.

Generates YARA rules from a set of malware samples, using string frequency scoring against a large goodware corpus to avoid noisy, false-positive-prone signatures.

python3 yarGen.py -m /malware_samples/ -o generated.yar

"Your Everyday Threat Intelligence" — a platform for aggregating and de-duplicating observables, TTPs and threat data from multiple feeds into one queryable, taggable repository for an analyst team to build on.

Enterprise-grade open-source monitoring platform — network, server and application monitoring with alerting, widely used as the backbone of an internal visibility/blue-team baseline.

A network security monitor rather than a signature-matching IDS — transforms traffic into rich, structured logs (connections, DNS, HTTP, files…) that a SOC actually hunts through.

zeek -r capture.pcap