防御
========================================

日志检查
----------------------------------------
- `Sysmon <https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon>`_
- `LastActivityView <http://www.nirsoft.net/utils/computer_activity_view.html>`_
- `Regshot <https://sourceforge.net/projects/regshot/>`_
- `teler <https://github.com/kitabisa/teler>`_ Real-time HTTP Intrusion Detection

终端监控
----------------------------------------
- `attack monitor <https://github.com/yarox24/attack_monitor>`_ Endpoint detection & Malware analysis software
- `artillery <https://github.com/BinaryDefense/artillery>`_ The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
- `yurita <https://github.com/paypal/yurita>`_ Anomaly detection framework @ PayPal
- `crowdsec <https://github.com/crowdsecurity/crowdsec>`_ An open-source, lightweight agent to detect and respond to bad behaviours
- `tracee <https://github.com/aquasecurity/tracee>`_ Linux Runtime Security and Forensics using eBPF

XSS防护
----------------------------------------
- `js xss <https://github.com/leizongmin/js-xss>`_
- `DOMPurify <https://github.com/cure53/DOMPurify>`_
- `google csp evaluator <https://csp-evaluator.withgoogle.com/>`_

配置检查
----------------------------------------
- `Attack Surface Analyzer <https://github.com/microsoft/AttackSurfaceAnalyzer>`_ analyze operating system's security configuration for changes during software installation.
- `gixy <https://github.com/yandex/gixy>`_ Nginx 配置检查工具
- `dockerscan <https://github.com/cr0hn/dockerscan>`_ Docker security analysis & hacking tools

安全检查
----------------------------------------
- `lynis <https://github.com/CISOfy/lynis>`_ Security auditing tool for Linux, macOS, and UNIX-based systems
- `linux malware detect <https://github.com/rfxn/linux-malware-detect>`_

IDS
----------------------------------------
- `ossec <https://github.com/ossec/ossec-hids>`_
- `yulong <https://github.com/ysrc/yulong-hids>`_
- `AgentSmith <https://github.com/DianrongSecurity/AgentSmith-HIDS>`_
- `ByteDance HIDS  <https://github.com/bytedance/ByteDance-HIDS>`_ Cloud-Native Host-Based Intrusion Detection

RASP
----------------------------------------
- `Elkeid <https://github.com/bytedance/Elkeid>`_ Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture
- `openrasp <https://github.com/baidu-security/openrasp-iast>`_ IAST 灰盒扫描工具

SIEM
----------------------------------------
- `panther <https://github.com/panther-labs/panther>`_ Detect threats with log data and improve cloud security posture

威胁情报
----------------------------------------
- `threatfeeds <https://threatfeeds.io/>`_
- `abuseipdb <https://www.abuseipdb.com/>`_

APT
----------------------------------------
- `APT Groups and Operations <https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml>`_
- `APTnotes <https://github.com/kbandla/APTnotes>`_
- `APT Hunter <https://github.com/ahmedkhlief/APT-Hunter>`_ Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

入侵检查
----------------------------------------
- `huorong <https://www.huorong.cn/>`_
- `check rootkit <http://www.chkrootkit.org>`_
- `rootkit hunter <http://rkhunter.sourceforge.net/>`_
- `PC Hunter <http://www.xuetr.com/>`_
- `autoruns <https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns>`_

进程查看
----------------------------------------
- `Process Explorer <https://docs.microsoft.com/zh-cn/sysinternals/downloads/process-explorer>`_
- `ProcessHacker <https://processhacker.sourceforge.io/>`_

Waf
----------------------------------------
- `naxsi <https://github.com/nbs-system/naxsi>`_
- `ModSecurity <https://github.com/SpiderLabs/ModSecurity>`_
- `ngx_lua_waf <https://github.com/loveshell/ngx_lua_waf>`_
- `OpenWAF <https://github.com/titansec/OpenWAF>`_

病毒在线查杀
----------------------------------------
- `virustotal <https://www.virustotal.com/>`_
- `virscan <http://www.virscan.org>`_
- `habo <https://habo.qq.com>`_

WebShell查杀
----------------------------------------
- `D盾 <http://www.d99net.net/index.asp>`_
- `深信服WebShell查杀 <http://edr.sangfor.com.cn/backdoor_detection.html>`_
- `php malware finder <https://github.com/nbs-system/php-malware-finder>`_

规则 / IoC
----------------------------------------
- `malware ioc <https://github.com/eset/malware-ioc>`_
- `fireeye public iocs <https://github.com/fireeye/iocs>`_
- `signature base <https://github.com/Neo23x0/signature-base>`_
- `yara rules <https://github.com/Yara-Rules/rules>`_
- `capa rules <https://github.com/fireeye/capa-rules>`_ standard collection of rules for capa
- `AttackDetection <https://github.com/ptresearch/AttackDetection>`_ Suricata PT Open Ruleset
- `DailyIOC <https://github.com/StrangerealIntel/DailyIOC>`_ IOC from articles, tweets for archives

威胁检测
----------------------------------------
- `ARTIF <https://github.com/CRED-CLUB/ARTIF>`_ An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data

Security Advisories
----------------------------------------
- `Apache httpd Security Advisories  <https://httpd.apache.org/security/>`_
- `Apache Solr <https://lucene.apache.org/solr/security.html>`_
- `Apache Tomcat <https://tomcat.apache.org/security-8.html>`_
- `Jetty Security Reports <https://www.eclipse.org/jetty/documentation/current/security-reports.html>`_
- `Nginx Security Advisories <http://nginx.org/en/security_advisories.html>`_
- `OpenSSL <https://www.openssl.org/news/vulnerabilities.html>`_

Security Tracker
----------------------------------------
- `Nginx Security Tracker <https://security-tracker.debian.org/tracker/source-package/nginx>`_

匹配工具
----------------------------------------
- `yara <https://github.com/VirusTotal/yara>`_ The pattern matching swiss knife
- `capa <https://github.com/fireeye/capa>`_ The FLARE team's open-source tool to identify capabilities in executable files.

DoS防护
----------------------------------------
- `Gatekeeper <https://github.com/AltraMayor/gatekeeper>`_` open-source DDoS protection system

对手模拟
----------------------------------------
- `sliver <https://github.com/BishopFox/sliver>`_ Adversary Simulation Framework

入侵防护
----------------------------------------
- `fail2ban <https://github.com/fail2ban/fail2ban>`_