Security lists for SOC/DFIR detections

🐾 Threat Hunting:

ThreatHunting searches

📂 My Detection Lists

📋 Lists: https://github.com/mthcht/awesome-lists/tree/main/Lists
🕵️‍♂️ ThreatHunting Guides: https://mthcht.medium.com/list/threat-hunting-708624e9266f
🚰 Suspicious Named pipes: suspicious_named_pipe_list.csv
🌐 Suspicious TLDs (updated automatically): [suspicious_TLDs]
🌐 Suspicious ASNs (updated automatically): [suspicious ASNs]
🌐 FYI Maxmind GeoIP Database (updated automatically): GeoIP DB
🔧 Suspicious Windows Services: suspicious_windows_services_names_list.csv
⏲️ Suspicious Windows Tasks: suspicious_windows_tasks_list.csv
🚪 Suspicious destination port: suspicious_ports_list.csv
🛡️ Suspicious Firewall rules: suspicious_windows_firewall_rules_list.csv
🆔 Suspicious User-agent: suspicious_http_user_agents_list.csv
📇 Suspicious USB Ids: suspicious_usb_ids_list.csv
🔢 Suspicious MAC address: suspicious_mac_address_list.csv
📛 Suspicious Hostname: suspicious_hostnames_list.csv
🌐 Suspicious Browser Extensions: Browser Extensions
📧 Microsoft App IDs List - BEC Detection microsoft_apps_list.csv
🧮 Metadata Executables: executables_metadata_informations_list.csv
🕸️ DNS over HTTPS server list: dns_over_https_servers_list.csv
🕸️ Dynamic DNS domains list: dyndns_list.csv
🕸️ Domains : [sinkholed servers]
🕳️ Sinkholed Domains : sinkholed_domains.csv
🕳️ Sinkholed Site: SINKHOLED
📚 Hijacklibs (updated automatically): hijacklibs_list.csv
🌐 TOR Nodes Lists (updated automatically): [TOR]
🛠️ LOLDriver List (updated automatically): loldrivers_only_hashes_list.csv
🛠️ Malicious Bootloader List (updated automatically): malicious_bootloaders_only_hashes_list.csv
📜 Malicious SSL Certificates List (updated automatically): ssl_certificates_malicious_list.csv
🖥️ RMM detection: [RMM]
👤🔑 Important Roles and groups for AD/EntraID/AWS: [permissions]
💻🔒 Ransomware known file extensions: ransomware_extensions_list.csv
💻🔒 Ransomware known file name ransom notes: ransomware_notes_list.csv
📝 Windows ASR rules: windows_asr_rules.csv
🌐 DNSTWIST Lists (updated automatically): DNSTWIST Default Domains + script
🌍 VPN IP address Lists (updated automatically):
- 🛡️ NordVPN: nordvpn_ips_list.csv
- 🛡️ ProtonVPN: protonvpn_ip_list.csv
- 🛡️ SurfShark: surfshark_vpn_servers_domains_and_ips_list.csv
- 🛡️ MullVad: mullvad_relay_servers_ips_list.csv
🌍 PROXIES PROXY IP/Port Lists
🏢 Companies IP Range Lists (updated automatically): Default Lists + script / Microsoft
📍 GeoIP services Lists: ip_location_sites_list.csv
🧬 Yara rules: Threat Hunting yara rules
🧬 Offensive Tools detection patterns: offensive_tool_keywords.csv
🧬 Greyware Tools detection patterns: greyware_tool_keyword.csv
🧬 AV signatures keywords: signature_keyword.csv
🧬 Microsoft Defender AV signatures lists: [Defender] + yara
🧬 ClamAV signatures lists: [ClamAV]
🔗 Others correlation Lists: [Others]
📋 Lists i need to finish: [todo]

I regularly update most of these lists after each tool i analyze in my detection keywords project

Other Lists

🛡️ DFIR:

🚫 IOC Feeds/Blacklists:

🐙 Github

More github lists

🖥️ SIEM/SOC/PurpleTeam related:

📊 TI TTP/Framework/Model/Trackers

🕵️‍♂️ Investigation

📊 TI checks

🔬 Sandbox / Emulation

🧩 Data manipulation

📡 Detection Resources

🌐 Security News

📺 Youtube/Twitch channels

🎙️ Podcasts

💬 Discord /Slack channels

📚 Training

DFIR

13cubed - Investigating Windows Endpoints 13cubed.com -windows endpoints
13cubed - Investigating Windows Memory 13cubed.com -windows memory
13cubed - Investigating Linux Devices 13cubed.com - linux
SANS: FOR500
SANS: FOR508
Defensive-security: Linux-live-forensics
@0gtweet - Forensic course: Mastering Windows Forensics
@DebugPrivilege : Forensic Debugging free course InsightEngineering
Challenges:
- Arsenal Recon Disks Images for DFIR: publicly-accessible-disk-images
- @inversecos - APT Emulation Labs: xintra
- @TheDFIRReport : LABs with logs from the existing reports dfir-labs
- @ACEresponder: Courses with Detailed Explanations and Labs aceresponder.com
- @binaryz0ne: DFIR challenges with Datasets + Linux forensic workshop

SOC

tryhackme - SOC lvl 1
letsdefend.io @chrissanders88 - letsdefend.io
Constructing Defense constructingdefense.com
SANS: SANS555
Xintra: Attacking and Defending Azure M365
Challenges:
- Splunk Boss Of The SOC - BOTS
  - BOTS dataset v1
  - BOTS dataset v2
  - BOTS dataset v3
@TheDFIRReport : LABs with logs from the existing reports dfir-labs
@ACEresponder: Courses with Detailed Explanations and Labs aceresponder.com
@inversecos - APT Emulation Labs: xintra

Offensive

Challenges

RE / Malware Analysis / Deep Dive

OpenSecurityTraining2

📚 Books

DFIR

Malware Anaysis

SOC

Deep Dive

Exploitation

📚 Knowledge sites

🧪 LAB

📦 Others

🏷️ Bookmarks

⭐ Bookmarks with all my lists to import in your browser (updated automatically) UPDATE Bookmarks

mthcht/awesome-lists

Security lists for SOC/DFIR detections

🐾 Threat Hunting:

📂 My Detection Lists

Other Lists

🛡️ DFIR:

🚫 IOC Feeds/Blacklists:

🐙 Github

🖥️ SIEM/SOC/PurpleTeam related:

📊 TI TTP/Framework/Model/Trackers

🕵️‍♂️ Investigation

📊 TI checks

🔬 Sandbox / Emulation

🧩 Data manipulation

📡 Detection Resources

🌐 Security News

📺 Youtube/Twitch channels

🎙️ Podcasts

💬 Discord /Slack channels

📚 Training

DFIR

SOC

Offensive

Challenges

RE / Malware Analysis / Deep Dive

📚 Books

DFIR

Malware Anaysis

SOC

Deep Dive

Exploitation

📚 Knowledge sites

🧪 LAB

📦 Others

🏷️ Bookmarks