This is the repository for indicators of compromise (IOCs) and other data for threat intelligence articles posted on the Palo Alto Networks Unit 42 website.

A concise, directive, specific, flexible, and free incident response plan template

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.

Scripts for rapid Windows endpoint "tactical triage" and investigations with Velociraptor and KAPE

This project aims to compare and evaluate the telemetry of various EDR products.

✍️ A curated list of CVE PoCs.

These are the labs for my Intro class. Yes, this is public. Yes, this is intentional.

SANS has a massive list of posters available for quick reference to aid you in your security learning.

A curated list of free courses & certifications.

Cloud Native Runtime Security

This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Certified Kubernetes Security Specialist (CKS) Preparation Guide - Curriculum v1.26

Bootstrap Kubernetes the hard way. No scripts.

Certified Kubernetes Administrator - CKA Course

This repo is about Active Directory Advanced Threat Hunting

Curating the best DevSecOps resources and tooling.

All-in-one auditing toolkit for identifying common security issues in managed Kubernetes environments. Currently supports Amazon EKS.

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

A collection of various SIEM rules relating to malware family groups.

Automation to assess the state of your M365 tenant against CISA's baselines

Splunk Security Content

Security Content for the PEAK Threat Hunting Framework

Useful resources for SOC Analyst and SOC Analyst candidates.

Cover various security approaches to attack techniques and also provides new discoveries about security breaches.

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.