Security lists for SOC/DFIR detections

Threat Hunting:

ThreatHunting searches

My Detection Lists

📋 Lists: https://github.com/mthcht/awesome-lists/tree/main/Lists
🕵️‍♂️ ThreatHunting Guides: https://mthcht.medium.com/list/threat-hunting-708624e9266f
🚰 Suspicious Named pipes: suspicious_named_pipe_list.csv
🔧 Suspicious Windows Services: suspicious_windows_services_names_list.csv
⏲️ Suspicious Windows Tasks: suspicious_windows_tasks_list.csv
🚪 Suspicious destination port: suspicious_ports_list.csv
🛡️ Suspicious Firewall rules: suspicious_windows_firewall_rules_list.csv
🆔 Suspicious User-agent: suspicious_http_user_agents_list.csv
📇 Suspicious USB Ids: suspicious_usb_ids_list.csv
🔢 Suspicious MAC address: suspicious_mac_address_list.csv
📛 Suspicious Hostname: suspicious_hostnames_list.csv
🧮 Metadata Executables: executables_metadata_informations_list.csv
🕸️ DNS over HTTPS server list: dns_over_https_servers_list.csv
📚 Hijacklibs (updated automatically): hijacklibs_list.csv
🌐 TOR Nodes Lists (updated automatically): https://github.com/mthcht/awesome-lists/tree/main/Lists/TOR
🛠️ LOLDriver List (updated automatically): loldrivers_only_hashes_list.csv
🛠️ Malicious Bootloader List (updated automatically): malicious_bootloaders_only_hashes_list.csv
📜 Malicious SSL Certificates List (updated automatically): ssl_certificates_malicious_list.csv
🖥️ RMM detection: https://github.com/mthcht/awesome-lists/tree/main/Lists/RMM
👤🔑 Important Roles and groups for AD/EntraID/AWS: [permissions]
💻🔒 Ransomware known file extensions: ransomware_extensions_list.csv
💻🔒 Ransomware known file name ransom notes: ransomware_notes_list.csv
📝 Windows ASR rules: windows_asr_rules.csv
🌐 DNSTWIST Lists (updated automatically): DNSTWIST Default Domains + script
🌍 VPN IP address Lists (updated automatically):
- 🛡️ NordVPN: nordvpn_ips_list.csv
- 🛡️ ProtonVPN: protonvpn_ip_list.csv
🏢 Companies IP Range Lists (updated automatically): Default Lists + script
🔗 Others correlation Lists: https://github.com/mthcht/awesome-lists/tree/main/Lists/Others
📋 Lists i need to finish: https://github.com/mthcht/awesome-lists/tree/main/todo

I regularly update most of these lists after each tool i analyze in my detection keywords project

Other Lists

IOC Feeds/Blacklists:

SIEM/SOC related:

Investigation

TI

More TI

Sandbox

Data manipulation

Detection Resources

DFIR

Security News

Formations

DFIR

@inversecos - APT Emulation Labs: xintra
13cubed - Investigating Windows Endpoints: 13cubed.com
@0gtweet - Forensic course: Mastering Windows Forensics
SANS: SANS508
Defensive-security: Linux-live-forensics
@TheDFIRReport : LABs with logs from the existing reports dfir-labs
@DebugPrivilege : Forensic Debugging free course InsightEngineering

Others

mthcht/awesome-lists

Security lists for SOC/DFIR detections

Threat Hunting:

My Detection Lists

Other Lists

IOC Feeds/Blacklists:

SIEM/SOC related:

Investigation

TI

More TI

Sandbox

Data manipulation

Detection Resources

DFIR

Security News

Formations

DFIR

Others