Skip to content

@activecm Active Countermeasures

Change the repository type filter

All

    Repositories list

    38 repositories

    • rita

      Public
      Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
      log-analysisincident-responseintrusion-detection
      log-analysisincident-responseintrusion-detectionnetwork-monitoringthreat-huntingbeaconscyber-securityzeeksecurity-toolsthreat-intelligence
      Go
      •
      GNU General Public License v3.0
      •58•548•16•6•Updated Apr 2, 2026Apr 2, 2026

    • docker-zeek

      Public
      Run zeek with zeekctl in docker
      dockerhacktoberfestzeek
      dockerhacktoberfestzeekzeekctl
      Go
      •
      GNU General Public License v3.0
      •22•63•7•4•Updated Mar 27, 2026Mar 27, 2026

    • zeek-open-connections

      Public
      Zeek
      •
      GNU General Public License v3.0
      •4•17•1•0•Updated Mar 24, 2026Mar 24, 2026

    • espy

      Public
      Endpoint detection for remote hosts for consumption by RITA and Elasticsearch
      Go
      •
      GNU General Public License v3.0
      •20•80•7•0•Updated Mar 19, 2026Mar 19, 2026

    • BeaKer

      Public
      Beacon Kibana Executable Report. Aggregates Sysmon Network Events With Elasticsearch and Kibana
      Shell
      •
      GNU General Public License v3.0
      •44•302•3•2•Updated Mar 19, 2026Mar 19, 2026

    • zeek-log-transport

      Public
      This script ships logs from Zeek to AC-Hunter
      Shell
      •3•7•3•3•Updated Mar 19, 2026Mar 19, 2026

    • ACH-Zeek

      Public
      Zeek installer packaged with AC-Hunter
      Shell
      •0•0•0•0•Updated Mar 19, 2026Mar 19, 2026

    • passer

      Public
      Passive service locator, a python sniffer that identifies servers, clients, names and much more
      pythonlinuxdns
      pythonlinuxdnssecuritypcappacketsgplv3sniffernetwork-monitoringmacosx
      Python
      •
      GNU General Public License v3.0
      •54•262•0•2•Updated Feb 9, 2026Feb 9, 2026

    • tcp-sig-json

      Public
      Json file that holds TCP signatures for passive OS fingerprinting
      Python
      •
      GNU General Public License v3.0
      •1•1•0•0•Updated Feb 9, 2026Feb 9, 2026

    • shell-lib

      Public archive
      Shell Scripts Used Across ActiveCM Projects
      Shell
      •
      BSD 3-Clause "New" or "Revised" License
      •3•4•3•1•Updated Feb 5, 2026Feb 5, 2026

    • rita-legacy

      Public
      Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
      dnssecurityanalytics
      dnssecurityanalyticsanalysislogsthreatbeaconscanningbeacon-sniffernetwork-traffic
      Go
      •
      GNU General Public License v3.0
      •353•2.5k•81•4•Updated Jan 12, 2026Jan 12, 2026

    • zeek-log-tools

      Public
      Tools for working with Zeek logs
      Shell
      •
      GNU General Public License v3.0
      •0•1•0•0•Updated Jun 19, 2025Jun 19, 2025

    • zcutter

      Public
      Extracts fields from zeek logs, compatible with zeek-cut
      tsvconverterjson
      tsvconverterjsonpython3python-3zeektsv-parser
      Python
      •
      GNU General Public License v3.0
      •6•27•0•0•Updated Jul 10, 2024Jul 10, 2024

    • safelist-tools

      Public
      Tools for working with the safelist (formerly whitelist)
      Go
      •
      GNU General Public License v3.0
      •4•5•1•1•Updated Apr 11, 2024Apr 11, 2024

    • pcap-stats

      Public
      Learn about a network from a pcap file or reading from an interface
      pythonpcaptraffic-analysis
      pythonpcaptraffic-analysispython3scapynetwork-analysis
      Python
      •
      GNU General Public License v3.0
      •5•29•1•0•Updated Apr 6, 2024Apr 6, 2024

    • sniffer-template

      Public
      Template for building a packet sniffer
      pythontemplatepcap
      pythontemplatepcappython3pcap-filesscapypcap-analyzerpcap-library
      Python
      •
      GNU General Public License v3.0
      •5•15•0•0•Updated Mar 25, 2024Mar 25, 2024

    • threat-tools

      Public
      Tools for simulating threats
      Python
      •
      GNU General Public License v3.0
      •37•203•0•0•Updated Oct 27, 2023Oct 27, 2023

    • save_json_stream

      Public
      JSON TCP stream importer for RITA and AC-Hunter
      python3threat-huntingpython-3
      python3threat-huntingpython-3zeekritazeek-idsbricata
      Python
      •
      GNU General Public License v3.0
      •2•1•0•0•Updated Sep 8, 2023Sep 8, 2023

    • rita-bl

      Public archive
      Real Intelligence Threat Analytics -- Blacklist Database
      Go
      •
      GNU General Public License v3.0
      •8•10•2•0•Updated Jul 12, 2023Jul 12, 2023

    • smudge

      Public
      Passive OS detection based on SYN packets without Transmitting any Data
      Python
      •
      GNU General Public License v3.0
      •9•50•5•0•Updated Mar 29, 2023Mar 29, 2023

    • zeekcfg

      Public
      A node.cfg generator for zeekctl
      Go
      •
      MIT License
      •4•7•3•0•Updated Nov 11, 2022Nov 11, 2022

    • zeek-log-clean

      Public
      Delete Zeek log files until disk usage is under a given threshold
      Shell
      •
      MIT License
      •1•3•1•0•Updated Jul 1, 2022Jul 1, 2022

    • bad-asn-list

      Public
      An open source list of ASNs known to belong to cloud, managed hosting, and colo facilities.
      117•2•0•0•Updated Jun 22, 2022Jun 22, 2022

    • pcap-resources

      Public
      Support files and tools for pcap analysis and packet capture
      GNU General Public License v3.0
      •3•3•0•0•Updated Mar 1, 2022Mar 1, 2022

    • certificate-issues

      Public
      Identifies certificate problems from Zeek ssl log files
      Shell
      •
      GNU General Public License v3.0
      •0•4•0•0•Updated Jan 19, 2022Jan 19, 2022

    • mgosec

      Public archive
      A Small Helper Library For Securing MongoDB Connections with Golang
      Go
      •
      MIT License
      •0•4•1•0•Updated Dec 1, 2021Dec 1, 2021

    • get-release

      Public
      Github Action to get release information based on a tag
      JavaScript
      •
      MIT License
      •43•0•0•0•Updated Oct 19, 2021Oct 19, 2021

    • threat-hunting-labs

      Public
      Collection of walkthroughs on various threat hunting techniques
      HTML
      •
      GNU General Public License v3.0
      •19•77•0•0•Updated Aug 3, 2020Aug 3, 2020

    • bro-install

      Public archive
      An Installation Script for Bro IDS on Debian Based Systems
      Shell
      •7•20•0•0•Updated Jun 25, 2020Jun 25, 2020

    • pi_project_installer

      Public
      A support library and set of scripts to simplify installing software on the Raspberry Pi/Raspbian
      Shell
      •
      GNU General Public License v3.0
      •2•5•0•0•Updated Feb 4, 2020Feb 4, 2020
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.