Build software better, together

THORCollective / HEARTH

A community-driven repository for threat hunting ideas, methodologies, and research that serves as a central gathering place for hunters to share knowledge, collaborate on techniques, and advance the field of threat hunting.

cybersecurity infosec threat-hunting threatintel hunting threat-analysis threat-intelligence threat-intel threat-detection threathunting cybersec infosectools threatresearch cybersecurity-tools thrunting

Updated Sep 10, 2026
HTML

LOLESXi-Project / LOLESXi

Star

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of adversarial activities targeting ESXi hosts

dfir threat-hunting atomicredteam threatresearch detectionengineering

Updated Jul 25, 2026
JavaScript

regantemudo / dfir-playbooks

Star

Practical DFIR and incident response playbooks covering phishing, malware, ransomware, insider threats, and cloud security incidents for SOC and IR teams.

incident-response malware dfir ransomware threat-hunting threatintel threat-modeling incident-management incident-reports blueteam threat-intelligence threat-detection incident-analysis incident-response-plan digitalforensics threatresearch digitalforensic

Updated Sep 10, 2026
PHP

stairwell-inc / threat-research

Star

Repository of tools, YARA rules, and code-snippets from Stairwell's research team.

malware threat-hunting threatintel yara threat-intelligence threat-research threatresearch

Updated Jan 31, 2024
YARA

a2awais / Nation-State-APT-Intelligence

Star

Public CTI platform for tracking nation-state APT actors, campaigns, malware, IOCs, and threat activity.

incident-response threat-hunting threatintel threat-modeling iocs ttps enrichment-analysis threat-intelligence security-research apts threat-detection taxii2 stix2 national-security threatresearch

Updated Sep 14, 2026

DeathShotXD / 0xCr0ssCrush

Star

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

Updated Sep 15, 2026
Rust

WinterGate-IC / blackshield-threat-intel

Star

🛡️ BLACKSHIELD - Enterprise Threat Intelligence Database. 276K+ malicious IPs, 11K+ CIDR ranges, 4.5K+ malicious ASNs from 233+ threat feeds. Automated C2 tracking, ransomware blocklist, Tor exit nodes, VPN/proxy IPs, enemy nation ranges, and bulletproof hosting detection.

osint threat-hunting threatintel threat-modeling threat-analysis threat-intelligence threat-intel osint-resources safety-critical-systems threat-detection threatresearch

Updated May 29, 2026
Shell

Krishcalin / Attack-Surface-Management

Star

A state-of-the-art attack surface management tool of professional grade

threat-hunting vulnerability-management threat-intelligence attack-surface threat-detection threatresearch

Updated Jun 30, 2026
Python

lucas-link-code / Threat-Profiler

Star

Automates searches to pull IOC data from 15 APIs against public databases and community threat intelligence services

cybersecurity threatintel threat-analysis threat-intelligence threat-intel cyber-threat-intelligence threatresearch cybersecurity-tools cybersecurity-projects

Updated Jan 18, 2026
Python

MazTachINTX / CTM-TH-CASE-MANAGEMENT-PORTAL

Star

CTM-TH-CASE-MANAGEMENT-PORTAL

automation dfir threat-hunting threatintel threat-modeling autonomous-agents threat-analysis threat-intelligence threat-detection dfir-automation threatresearch dfir-tools

Updated Sep 2, 2026
TypeScript

iamcybher808 / docs-findings

Star

𝕯𝖊𝖆𝖙𝖍 - Focusing on Detection Engineering & Threat Hunting. There are other concepts here. Take a look!

phishing cybersecurity threat-hunting threatintel threat-modeling regular-expressions detection-rules threat-detection phishing-detection detection-engineering cybersecurity-education digitalforensics threatresearch cybersecurity-tools cybersecurity-projects detection-as-code

Updated Aug 29, 2026

lucas-link-code / Web-Digger

Star

performs static and dynamic analysis of websites to detect malicious patterns, obfuscation techniques, and threat indicators

cybersecurity threat-hunting threat-analysis threat-detection threatresearch cybersecurity-tools

Updated Jan 24, 2026
Python

R00t-Pi / akira-ransomware-threat-hunting

Star

Threat hunting and detection engineering project focused on Akira ransomware tradecraft, ATT&CK mapping, telemetry analysis, and behavioral Sigma rule development.

splunk cybersecurity ransomware threat-hunting threatintel threat-intelligence detection-rules blue-team akira mitre-attack threat-detection detection-engineering sigma-rules threatresearch soc-analyst ransomware-dectection akira-ransomware

Updated Jul 25, 2026

Abhayparashar31 / KRAB

Star

Centralized intelligence dashboard built in Obsidian, designed to correlate Threat Actors, Campaigns, Malware, Vulnerabilities, and MITRE ATT&CK techniques into a unified operational view.

osint cybersecurity obsidian threat-intelligence threatresearch

Updated Jul 7, 2026
Python

lepo4789 / Static-Malware-Analysis-Homelab

Star

Performed deep static analysis using tools like HxD, Cmder, HashCalc, BinText, XorSearch, FLOSS, UPX, and PEStudio to extract strings, identify file structure, detect obfuscation, and reveal indicators of compromise.