A collection of cybersecurity tools and resources that I've used or found valuable during my cyber security analyst training. Entries in italic are added / changed.
| Tool | Website | Description |
|---|---|---|
| Abuse | https://abuse.ch/ | A platform focused on threat intelligence. |
| DomainTools | https://whois.domaintools.com/ | Provides DNS and IP information on a domain. |
| Talos Intelligence | https://talosintelligence.com/ | A platform focused on threat intelligence provided by Cisco. |
| Censys | https://search.censys.io/ | A search engine for discovering devices and services exposed on the internet, offering insights into vulnerabilities. |
| Shodan | https://www.shodan.io/ | A search engine that scans and indexes devices connected to the internet, used for identifying network vulnerabilities. |
| Mitre Attack | https://attack.mitre.org/ | A comprehensive framework of adversarial tactics and techniques used by cyber attackers. |
| Mitre AEP | https://attack.mitre.org/resources/adversary-emulation-plans/ | Provides adversary emulation plans that simulate cyber threat actors to test and improve security defenses. |
| Mitre CAR | https://car.mitre.org/ | Cyber Analytics Repository that offers security analytics to help detect adversary behaviors on networks. |
| Mitre D3fend | https://d3fend.mitre.org/ | A knowledge base of cybersecurity countermeasures designed to help organizations protect against attacks. |
| Mitre Engage | https://engage.mitre.org/ | A framework designed to guide organizations in planning and executing cyber deception and engagement operations. |
| LOKI | https://github.com/Neo23x0/Loki | A simple scanner that checks for indicators of compromise (IoCs) using YARA rules and other heuristics. |
| THOR (Lite) | https://www.nextron-systems.com/thor-lite/ | A professional-grade forensic scanner that detects advanced threats and malicious activity. |
| Yara | https://virustotal.github.io/yara/ | A tool aimed at helping malware researchers identify and classify malware by writing flexible detection rules. |
| FENRIR | https://github.com/Neo23x0/Fenrir | A simple IOC scanner for Unix-based systems designed to be easily integrated into security incident response processes. |
| yarGen | https://github.com/Neo23x0/yarGen | A tool for generating YARA rules by extracting relevant strings from malware samples. |
| valhalla | https://valhalla.nextron-systems.com/ | A service offering a massive collection of curated YARA rules for detecting malware and threats. |
| YARAify | https://yaraify.abuse.ch/ | Provides a feed of YARA rules and allows scanning of files against YARA rules- |
| OpenCTI | https://www.opencti.io/ | An open-source platform designed to manage, store, and share cyber threat intelligence information. |
| MISP | https://www.misp-project.org/ | An open-source threat intelligence platform for sharing, storing, and correlating indicators of compromise. |
| IPinfo.io | https://ipinfo.io/ | Provides geolocation, ownership details, and privacy detection for IP addresses. |
| URLScan.io | https://urlscan.io/ | A web sandbox that scans and analyzes URLs for threats, generating detailed reports. |
| VirusTotal | https://www.virustotal.com/gui/ | Analyzes suspicious files and URLs to detect malware and shares findings with the security community. |
| ThreatFox | https://threatfox.abuse.ch/ | Community-driven threat intelligence platform for sharing, searching, and automating indicators of compromise (IOCs) related to malware. |
| Alerting and Detection Strategy Framework (ADS Framework) | https://github.com/palantir/alerting-detection-strategy-framework | Open-source framework and template for systematically developing, documenting, and validating alerting and detection strategies. |
| APIVoid | https://www.apivoid.com/ | API-driven cybersecurity service providing real-time threat intelligence, domain and IP reputation analysis, and automated enrichment for threat detection, prevention, and incident response. |
| Atomic Red Team | https://github.com/redcanaryco/atomic-red-team | Open-source library of small, portable tests mapped to MITRE ATT&CK, enabling security teams to simulate adversary techniques and validate detection and response capabilities. |
| TIBER-EU | https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html | European framework for threat intelligence-based ethical red teaming, providing guidance for organizations to test and improve cyber resilience through controlled, intelligence-led attack simulations. |
| Threat Modeling | https://owasp.org/www-project-threat-model/ | Structured process for identifying, assessing, and mitigating risks, threats, and vulnerabilities in applications, systems, or processes. |
| DREAD | https://threat-modeling.com/dread-threat-modeling/ | Risk assessment model that quantifies threats based on Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability, enabling prioritization of security risks using a numeric scoring system. |
| STRIDE Framework | https://en.wikipedia.org/wiki/STRIDE_model | Threat modeling framework categorizing threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, helping teams systematically identify and mitigate vulnerabilities. |
| PASTA | https://threat-modeling.com/pasta-threat-modeling/ | Process for Attack Simulation and Threat Analysis; a seven-stage threat modeling methodology that guides organizations from defining objectives to analyzing risks and impacts, enabling comprehensive and repeatable security assessments. |
| Tool | Website | Description |
|---|---|---|
| Zenmap | https://nmap.org/zenmap/ | The official graphical user interface (GUI) for Nmap. |
| Snort | https://www.snort.org/ | An open-source intrusion detection and prevention system (IDS/IPS). |
| NetworkMiner | https://www.netresec.com/?page=NetworkMiner | A network forensic analysis tool (NFAT) for extracting and analyzing data from network traffic. |
| Wireshark | https://www.wireshark.org/ | A network protocol analyzer used for network troubleshooting, analysis, and protocol development. |
| TShark | https://tshark.dev/ | The command-line version of Wireshark, offering similar functionalities for capturing and analyzing network traffic via CLI. |
| Brim | https://www.brimdata.io | The graphical user interface (GUI) for Zeek. |
| Tool | Website | Description |
|---|---|---|
| TCPView | https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview | Displays active TCP and UDP connections, including process ownership and connection states. |
| Process Explorer | https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer | Provides detailed information about running processes. |
| Wevtutil.exe | https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil | Command-line tool for managing Windows Event Logs, including querying, exporting, and clearing logs. |
| Sysmon | https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon | Monitors and logs detailed system activity to Windows Event Logs for security analysis. |
| Osquery | https://www.osquery.io | Uses SQL-like queries to collect and analyze operating system data for monitoring, compliance, and security. |
| Wazuh | https://wazuh.com/ | A free SIEM platform for threat detection, compliance, and IT security monitoring. |
| Process Hacker | https://processhacker.sourceforge.io/ | Open-source tool for monitoring processes, detecting malicious activity, and troubleshooting. |
| Autoruns | https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns | Shows programs configured to run at system startup or login in detail. |
| Procdump | https://learn.microsoft.com/en-us/sysinternals/downloads/procdump | Captures process dumps during CPU spikes or application crashes for debugging purposes. |
| Splunk | https://www.splunk.com/ | A platform for collecting, indexing, and analyzing machine-generated data in real-time. |
| rsyslog | https://www.rsyslog.com/ | High-performance log processing daemon for Linux; collects, filters, and forwards logs for SIEM integration. |
| logrotate | https://github.com/logrotate/logrotate | Automates rotation, compression, and removal of log files to simplify log management on busy systems. |
| Uncoder | https://uncoder.io/ | IDE and translation engine for detection engineering; converts detection rules (e.g., Sigma) |
| LOLBAS | https://lolbas-project.github.io/ | Curated project documenting Living Off The Land Binaries, Scripts, and Libraries (LOLBAS) that can be abused by attackers on Windows systems for privilege escalation, persistence, and defense evasion. |
| Tool | Website | Description |
|---|---|---|
| FTK Imager | https://www.exterro.com/digital-forensics-software/ftk-imager | A forensic imaging tool used to preview, image, and analyze digital evidence. |
| RegRipper | https://github.com/keydet89/RegRipper3.0 | Extracts and analyzes Windows registry data using plugins for incident response and forensics. |
| Zimmerman's Registry Explorer | https://ericzimmerman.github.io/ | Parses and analyzes Windows registry hives for forensic artifacts. |
| ShellBagExplorer | https://ericzimmerman.github.io/ | Analyzes ShellBag registry data to track folder access and browsing history. |
| Registry Viewer | https://ericzimmerman.github.io/ | Examines Windows registry files for forensic analysis of keys, values, and settings. |
| Autopsy | https://www.autopsy.com | Open-source digital forensics platform for investigating and analyzing hard drives and files. |
| Redline | https://fireeye.market/apps/211364 | Provides host investigative capabilities to detect malicious activity through memory and file analysis. |
| KAPE | https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape | Collects and processes forensic artifacts efficiently during investigations. |
| Volatility | https://github.com/volatilityfoundation/volatility | An open-source memory forensics framework for analyzing RAM dumps. |
| Velociraptor | https://docs.velociraptor.app/ | Endpoint monitoring and digital forensics tool. |
| The Hive | https://github.com/TheHive-Project/TheHive | An open-source incident response platform for managing security events collaboratively. |
| PE Tree | https://github.com/blackberry/pe_tree | Visualizes Portable Executable (PE) files to aid malware analysis. |
| Olevba | https://github.com/decalage2/oletools/wiki/olevba | Analyzes Microsoft Office documents to detect and extract malicious VBA macros and indicators of compromise. |
| Plaso (log2timeline) | https://plaso.readthedocs.io | Python-based tool for automatic creation of super timelines from logs and forensic artifacts for investigation. |
| theZoo | https://github.com/ytisf/theZoo | Public repository of live malware samples and source code for malware research, analysis, and education; enables safe access to a wide range of malware families for defensive and offensive security studies. |
| Tool | Website | Description |
|---|---|---|
| CAPE Sandbox | https://capev2.readthedocs.io/en/latest/index.html | Malware analysis sandbox focused on unpacking and analyzing malicious payloads and executables. |
| Any.run | https://any.run/ | Interactive online malware sandbox allowing real-time analysis of suspicious files and activities. |
| Hybrid Analysis | https://www.hybrid-analysis.com/ | Free malware analysis service powered by Falcon Sandbox for static and dynamic threat analysis. |
| Tool | Website | Description |
|---|---|---|
| Phish Tool | https://phishtool.com/ | A platform designed for detecting, analyzing, and managing phishing threats. |
| Message Header Analyzer | https://mha.azurewebsites.net/ | Parses and analyzes email headers to trace the path of messages and identify potential issues. |
| Mail Header Analyzer | https://mailheader.org/ | Makes email headers legible by parsing records for detailed analysis of message routing. |
| MXToolbox | https://mxtoolbox.com/ | Provides tools to analyze DNS, MX records, and email server configurations for troubleshooting. |
| PhishTank | https://phishtank.com/ | Community-driven platform to track, verify, and share information about phishing websites. |
| Spamhaus | https://www.spamhaus.org/ | Offers IP and domain reputation services to detect and block spam, malware, and other threats. |
| Google Messageheader | https://toolbox.googleapps.com/apps/messageheader/ | Analyzes email headers to identify delivery delays, their sources, and responsible parties. |
| Phishing IR Playbook | https://github.com/counteractive/incident-response-plan-template/blob/master/playbooks/playbook-phishing.md | A comprehensive playbook for investigating, remediating, and communicating during phishing incidents. |
| Tool | Website | Description |
|---|---|---|
| URL2PNG | https://www.url2png.com/ | Captures snapshots of websites through an intuitive API for integration into apps or workflows. |
| Wannabrowser | https://www.wannabrowser.net/ | Allows viewing HTML source code of websites using different user-agent perspectives to detect cloaking. |
| CVE Crowd | https://cvecrowd.com/ | A platform for discussing and sharing information about CVEs and vulnerabilities. |
| Fedisec Feeds | https://fedisecfeeds.github.io/ | Aggregates security-related data, including CVE updates, in JSON format for easy access. |
| Regexr | https://regexr.com/ | Interactive online tool for learning, building, and testing regular expressions. |
| BlueTeam-Tools | https://github.com/A-poc/BlueTeam-Tools | Curated collection of 65+ tools and resources for blue team and incident response, covering network discovery, vulnerability management, threat detection, and more. |
| Awesome Cybersecurity Blue Team | https://github.com/fabacab/awesome-cybersecurity-blueteam | Comprehensive, community-driven list of resources, tools, frameworks, and guides for blue teams, with a strong focus on open-source solutions for defense, monitoring, and incident response. |
| Blue-Team-Notes | https://github.com/Purp1eW0lf/Blue-Team-Notes | Collection of one-liners, scripts, tips, and screenshots for blue team operations, offering practical advice and quick solutions for defenders and incident responders. |
| Tool | Website | Description |
|---|---|---|
| PayloadsAllTheThings | https://github.com/swisskyrepo/PayloadsAllTheThings | Comprehensive collection of payloads, bypasses, and techniques for web application security testing, penetration testing, and CTFs |
| Purpose | Regex |
|---|---|
| Find IPs | \b([0-9]{1,3}\.){3}[0-9]{1,3}\b |
| Find MAC Addresses | ^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$ |
| Purpose | Search |
|---|---|
| Failed SSH | event.category: authentication AND system.auth.ssh.event: Failed |
| Accepted SSH | event.category: authentication AND system.auth.ssh.event: Accepted AND source.ip: ??? |
| Visualize HTTP Ingress | host.name: ??? AND network.protocol: http AND destination.port: 80 |
| Identify HTTP Scanning | network.protocol: http AND destination.port: 80 AND source.ip: ??? AND http.response.status_code: 404 |
| Identify HTTP Scanning | host.name: ??? AND network.protocol: http AND destination.port: 80 AND source.ip: ??? AND http.response.status_code: (200 OR 301 OR 302) |
| File Download | host.name: ??? AND process.name: chrome.exe AND winlog.event_id: 11 |
| Open Files in Outlook | host.name: ??? AND process.name: OUTLOOK.EXE AND winlog.event_id: 11 |
| LOLBAS | host.name: ??? AND winlog.event_id: (1 OR 3) AND (process.name: (mshta.exe OR certutil.exe OR regsvr32.exe) OR process.parent.name: (mshta.exe OR certutil.exe OR regsvr32.exe)) |
| Scripting | host.name: ??? AND winlog.event_id: (1 OR 3) AND (process.name: (*python* OR *php* OR *nodejs*) OR process.parent.name: (*python* OR *php* OR *nodejs*)) |
| Disable Defender | host.name: ??? AND (*DisableRealtimeMonitoring* OR *RemoveDefinitions*) |
| Log Deletion | host.name: ??? AND winlog.event_id: 1102 |
| Process Injection | host.name: ??? AND winlog.event_id: 8 |
| Creation of scheduled Task | host.name: ??? AND (winlog.event_id: 4698 OR (*schtasks* OR *Register-ScheduledTask*) |
| Registry Key Modification | host.name: ??? AND winlog.event_id: 13 AND winlog.channel: Microsoft-Windows-Sysmon/Operational |
| Registry Key Modification | host.name: ??? AND winlog.event_id: 13 AND winlog.channel: Microsoft-Windows-Sysmon/Operational AND process.name: (reg.exe OR powershell.exe) |
| Registry Persistence | host.name: ??? AND winlog.event_id: 13 AND winlog.channel: Microsoft-Windows-Sysmon/Operational AND registry.path: (*CurrentVersion\\Run* OR *CurrentVersion\\Explorer\\User* OR *CurrentVersion\\Explorer\\Shell*) |
| Visualize DNS C2 | network.protocol: dns AND NOT dns.question.name: *arpa |
| Find DNS C2 | host.name: ??? AND destination.ip: ??? AND destination.port: 53 |
| Visualize Egress | host.name: ??? AND network.protocol: http AND network.direction: egress AND destination.domain: ??? |
| Host discovery | winlog.event_id: 1 AND process.name: (whoami.exe OR hostname.exe OR net.exe OR systeminfo.exe OR ipconfig.exe OR netstat.exe OR tasklist.exe) |
| Internal network scans | source.ip: 10.0.0.0/8 AND destination.ip: 10.0.0.0/8 AND destination.port < 1024 |
| AD Enumeration | winlog.event_id: 3 AND source.ip: 10.0.0.0/8 AND destination.ip: 10.0.0.0/8 AND destination.port: (389 OR 636) AND NOT process.name: mmc.exe |
| High Priv Execution | winlog.event_id: 1 AND user.name: SYSTEM AND NOT winlog.event_data.ParentUser: "NT AUTHORITY\SYSTEM" |
| Service Permission Abuse | winlog.event_id: 13 AND registry.path: *HKLM\\System\\CurrentControlSet\\Services\\*\\ImagePath* |
| Mimikatz | winlog.event_id: 1 AND process.command_line: (*mimikatz* OR *DumpCreds* OR *privilege\:\:debug* OR *sekurlsa\:\:*) |
| LSASS Dump | winlog.event_id: 11 AND file.path: *lsass.DMP |
| DC Sync | winlog.event_id: 4662 AND winlog.event_data.AccessMask: 0x100 AND winlog.event_data.Properties: (*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* OR *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* OR *9923a32a-3607-11d2-b9be-0000f87a36b2* OR *89e95b76-444d-4c62-991a-0facbeda640c*) |
| Keylogger | *GetKeyboardState* or *SetWindowsHook* or *GetKeyState* or *GetAsynKeyState* or *VirtualKey* or *vKey* or *filesCreated* or *DrawText* |
| Data Exfiltration | *$ping* or *$ipconfig* or *$arp* or *$route* or *$telnet* or *$tracert* or *$nslookup* or *$netstat* or *$netsh* or *$smb* or *$smtp* or *$scp* or *$ssh* or *$wget* or *$curl* or *$certutil* or *$nc* or *$ncat* or *$netcut* or *$socat* or *$dnscat* or *$ngrok* or *$psfile* or *$psping* or *$tcpvcon* or *$tftp* or *$socks* or *$Invoke-WebRequest* or *$server* or *$post* or *$ssl* or *$encod* or *$chunk* or *$ssl* |
| PS ICMP Activity | *System.Net.Networkinformation.ping* |
| Impact | *del* or *rm* or *vssadmin* or *wbadmin* or *bcdedit* or *wevutil* or *shadow* or *recovery* or *bootstatuspolicy* |
| SharpKatz | *Invoke-SharpKatz*" AND message:"*username* |