Security lists for SOC/DFIR detections
A curated set of continuously updated detection lists and threat-hunting resources for SOC, CERT and CTI teams, covering suspicious domains, ASNs, TLDs, Windows services, named pipes, user agents and other indicators of compromise.
This repository curates lists used for threat hunting and detection engineering: search queries for Windows services, user agents, DNS-over-HTTPS traffic, suspicious TLDs, library hijacking, phishing and command-and-control patterns, alongside YARA rules. Many lists, such as suspicious TLDs, ASNs and a GeoIP database, are updated automatically.
It also maintains CSV lists of specific indicators of compromise, including suspicious Windows services and scheduled tasks, destination ports, firewall rules, user agents, USB IDs, mutex names, MAC addresses, hostnames, browser extensions, sinkholed and dynamic DNS domains, and Microsoft App IDs used in business-email-compromise detection, alongside separate threat-hunting guides.
The lists are aimed at SOC, CERT and cyber threat intelligence analysts doing detection and incident response work.