10.13. Defense

10.13.1. Log Inspection

• Sysmon

• LastActivityView

• Regshot

• teler Real-time HTTP Intrusion Detection

10.13.2. Terminal Monitoring

• attack monitor Endpoint detection & Malware analysis software

• artillery The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.

• yurita Anomaly detection framework @ PayPal

• crowdsec An open-source, lightweight agent to detect and respond to bad behaviours

• tracee Linux Runtime Security and Forensics using eBPF

10.13.3. XSS Protection

• js xss

• DOMPurify

• google csp evaluator

10.13.4. Configuration Checks

• Attack Surface Analyzer analyze operating system’s security configuration for changes during software installation.

• gixy Nginx Configuration check

• dockerscan Docker security analysis & hacking tools

10.13.5. Security Check

• lynis Security auditing tool for Linux, macOS, and UNIX-based systems

• linux malware detect

10.13.6. IDS

• ossec

• yulong

• AgentSmith

• ByteDance HIDS Cloud-Native Host-Based Intrusion Detection

10.13.7. RASP

• Elkeid Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture

• openrasp IAST grey box scanning tool

10.13.8. SIEM

• panther Detect threats with log data and improve cloud security posture

10.13.9. Threat Intelligence

• threatfeeds

• abuseipdb

10.13.10. APT

• APT Groups and Operations

• APTnotes

• APT Hunter Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

10.13.11. Intrusion Check

• huorong

• check rootkit

• rootkit hunter

• PC Hunter

• autoruns

10.13.12. Process check

• Process Explorer

• ProcessHacker

10.13.13. Waf

• naxsi

• ModSecurity

• ngx_lua_waf

• OpenWAF

10.13.14. Online virus detection

• virustotal

• virscan

• habo

10.13.15. WebShell killing

• D Shield

• Sangfor WebShell killing

• php malware finder

10.13.16. Rules/ IoC

• malware ioc

• fireeye public iocs

• signature base

• yara rules

• capa rules standard collection of rules for capa

• AttackDetection Suricata PT Open Ruleset

• DailyIOC IOC from articles, tweets for archives

10.13.17. Threat detection

• ARTIF An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data

10.13.18. Security Advisories

• Apache httpd Security Advisories

• Apache Solr

• Apache Tomcat

• Jetty Security Reports

• Nginx Security Advisories

• OpenSSL

10.13.19. Security Tracker

• Nginx Security Tracker

10.13.20. Match Tool

• yara The pattern matching swiss knife

• capa The FLARE team’s open-source tool to identify capabilities in executable files.

10.13.21. DoS Protection

• Gatekeeper <https://github.com/AltraMayor/gatekeeper>`_ open-source DDoS protection system

10.13.22. Adversary Simulation

• sliver Adversary Simulation Framework

10.13.23. Intrusion Prevention

• fail2ban