20:"$Sreact.view_transition" 21:I[9754,["/_next/static/chunks/2t36f5p4pjzlb.js","/_next/static/chunks/1gyqeidjm5eoa.js","/_next/static/chunks/0_fjnxc4tt_l_.js","/_next/static/chunks/1ymt1shyhmu-4.js","/_next/static/chunks/3kv2zf0i7s2wc.js","/_next/static/chunks/1vs_3g_g75zmk.js","/_next/static/chunks/2g4dh802s8oz3.js","/_next/static/chunks/1bc3f0shukf1j.js","/_next/static/chunks/192kgs9v_t14j.js","/_next/static/chunks/0z6pw0v5c_lx5.js","/_next/static/chunks/08r60e6icmtkc.js","/_next/static/chunks/3trx6c0i7_x-3.js","/_next/static/chunks/40sro5bzp9bi_.js","/_next/static/chunks/1wgf3tk38y6cf.js"],"ProjectDetail"] 22:T52da, awesome-lists — 面向 SOC/DFIR 检测的精选安全列表

面向 SOC / CERT / CTI 团队

安全运营的精选清单。
纷繁信号，汇聚为一条可用的检测流。

awesome-lists 是安全运营的汇聚漏斗：把散落在各处的可疑指标族整理归类，汇成一条有序的检测带，并按稳定节奏自动更新，让防御团队始终跟得上攻击者留下的痕迹。

YARA 威胁狩猎 DFIR IOC 订阅检测工程 MIT

仓库 · mthcht/awesome-lists / GitHub / 指标清单自动更新

01 / 来源流

各异的入站指标族

一份总览，众多不寻常的来源

失陷指标很少以统一形态出现。awesome-lists 为蓝队真正会去查的指标族分别建册，各类独立维护又统一更新，让每一次狩猎都不至于基于过期的坐标。

命名管道

攻击者用于持久化与横向移动的少见 IPC 名称。

可疑前缀清单

TLD 与域名

在钓鱼与 C2 基础设施中反复出现的顶级域名与域名模式。

网络清单

ASN

承载恶意流量的自治系统号，用于划定范围与分诊。

地理拦截清单

Windows 服务

终端上值得审计的服务名，是常见落脚点与持久化区域。

终端清单

数字证书

真实恶意软件用于传输与信任的颁发者及主题指纹。

TLS 清单

02 / 漏斗收束

多源汇一

散乱指标在此收束，变得可以直接使用

各类指标分开收集，但真正的价值在汇合处显现。这里的收束把异质清单并成可直接行动的材料，而不是留下五份互不相通的表格。

命名管道 TLD / 域名 ASN Windows 服务证书一条有序检测带

03 / 指标族

漏斗背后的清单册

按分析师本来的思考方式组织

这不是一堆零散链接，而是按防御分工归类的集合。每一族都保留可供直接写入检测或狩猎线程的记录。

狩猎与检测

威胁狩猎关键词可直接检索
检测工程资源规则与模型
可疑指标清单自动更新
UA 与 DoH 模式查询示例

响应与分诊

IOC 订阅与黑名单网络范围
DFIR 工具资源取证工具箱
勒索软件扩展名清单分诊
勒索信文件名分诊

04 / 检测带

有序产出

为 SOC/CERT/CTI 构建一条有序带

汇聚后的材料呈现为稳定产出：一套团队可自上而下浏览、分配责任人，并转化为日志查询、狩猎规则与行动手册的有序集合。

导览与分类

面向 SOC、CERT 与 CTI 团队

索引

检测指南与搜索示例

服务 / UA / DoH / TLD 场景

指南

可疑指标清单册

命名管道、TLD、ASN、Windows 服务、证书

数据

DFIR 与响应工具箱

Eric Zimmerman 工具、Hayabusa、chainsaw

工具

威胁狩猎 YARA 规则

以可复用格式落地的模式化检测

规则

IOC 订阅与黑名单

一站式汇集外部来源

05 / 狩猎指南

从清单到假设

如何使用这些清单

选定一个指标族从清单册入手
编写查询SIEM / EDR
参考搜索示例指南已附
据分诊结果迭代持续打磨

场景覆盖

Windows 服务持久化
用户代理检测
DNS over HTTPS检测
可疑 TLD网络

06 / DFIR 火力库

一套聚焦的响应工具

集合真正指向的、具名的工具

DFIR 部分呈现的是具体可用的工具，而非空泛承诺，让应急人员从检测带直接转入取证检视。

终端与日志分诊

Eric Zimmerman 工具集取证痕迹
Hayabusa事件日志分析
chainsaw快速分诊

支撑数据

Windows ASR 规则加固
勒索软件扩展名清单识别
勒索信文件名行动手册

07 / 更新

会自我更新的数据流

指标会过时，这套清单不会。

在更新的数据流更新节奏自动 · 定期

这些清单按固定节奏自动刷新，所以同一套检测带，上一季度抓住过某个攻击者，眼下仍能指向下一个大概率会用到的路径。这里老实承诺的是节奏，而非凭空捏造的某个时间点。

mthcht/awesome-lists · 仓库威胁狩猎关键词站点威胁狩猎关键词清单威胁狩猎 YARA 规则

23:T5a05, awesome-lists — Curated security lists for SOC/DFIR detections

Curated for SOC / CERT / CTI

Awesome Security lists.
Many signals. One usable detection feed.

awesome-lists is a living funnel for security operations: it gathers suspicious indicator families from across the field, sorts them into a single ordered detection lane, and regenerates on a reliable cadence so blue teams keep pace with what attackers leave behind.

YARA threat hunting dfir ioc feeds detection engineering cti MIT

repo · mthcht/awesome-lists / github / indicator families updated automatically

01 / source streams

Diverse incoming families

One catalog, many uneasy sources

Indicators of compromise rarely arrive uniform. awesome-lists holds separate registers for the families blue teams actually look for, each maintained independently and jointly refreshed so a hunt never runs on stale coordinates.

Named pipes

Uncommon IPC names attackers lean on for persistence and lateral movement.

suspicious-prefix register

TLDs & domains

Top-level domains and domain patterns that recur in phishing and C2 infrastructure.

network register

ASNs

Autonomous systems that host hostile traffic, useful for scoping and triage.

geo-block register

Windows services

Service names worth auditing on endpoints, a frequent foothold and persistence locus.

endpoint register

Certificates

Issuer and subject fingerprints used by real malware for transport and trust.

tls register

02 / funnel junction

Many-to-one convergence

The choke point where scattered indicators become actionable

Each family is collected separately, but the value appears the moment they converge. The junction merges heterogeneous registers into decision-ready material rather than leaving five disconnected spreadsheets.

named pipes TLDs / domains ASNs Windows services certificates one ordered detection lane

03 / indicator families

The registers behind the funnel

Organized into the categories analysts already think in

Rather than a pile of links, the collection is grouped by defensive discipline. Each family keeps a record you can drop straight into a detection or hunt thread.

Hunt & detect

Threat hunting keywordssearch ready
Detection engineering resourcesrules & models
Suspicious indicator listsauto-updated
User agent & DoH patternsquery examples

Respond & triage

IOC feeds / blacklistsnetwork scope
DFIR tool resourcesforensic kit
Ransomware extensions listtriage
Ransom-note filenamestriage

04 / detection lane

The ordered output

A single, ordered lane built for SOC/CERT/CTI

The converged material reads as a stable output: an ordered set a team can scan top to bottom, assign ownership, and turn into log queries, hunting rules, and playbooks.

Legend & categories

For SOC, CERT & CTI teams

index

Detection guides & search examples

Service / UA / DoH / TLD scenarios

guides

Suspicious indicator registers

Named pipes, TLDs, ASNs, Windows svc, certs

data

DFIR & response kit

Eric Zimmerman tools, Hayabusa, chainsaw

tools

Threat hunting YARA rules

Patterned detections in a durable format

rules

IOC feeds & blacklists

External sources collected in one place

feeds

05 / hunt guides

From list to hypothesis

How to use the lists

Pick a familystart register
Write the querysiem / edr
Search examplesguides included
Refine on triageiterate

Scenario coverage

Windows servicespersistence
User agentsdetection
DNS over HTTPSdetection
Suspicious TLDsnetwork

06 / DFIR arsenal

A focused response kit

Named tools the collection actually points to

The DFIR section surfaces concrete instruments rather than vague promises, letting responders move from the lane straight into artifact inspection.

Endpoint & log triage

Eric Zimmerman toolsetforensic artifacts
Hayabusaevent log analysis
chainsawfast triage

Supporting data

Windows ASR ruleshardening
Ransomware extension listsidentification
Ransom-note filenamesplaybook

07 / regeneration

A feed that renews

Indicators age. This collection does not.

live feed regeneration cadence automatic · regular schedule

The registers are refreshed automatically on a regular basis, so the same lane that caught an attacker last quarter still points at what the next one is likely to use. Cadence, not a manufactured timestamp, is the honest promise here.

mthcht/awesome-lists · repository ThreatHunting keywords site ThreatHunting keywords lists ThreatHunting YARA rules

24:T48f,Of the three, only Signal Aggregator expresses the project's actual mechanism rather than a marketing posture. The repo is fundamentally an aggregation instrument: it collects many distrustful indicator families (named pipes, TLDs, ASNs, Windows services, certificates) and converges them into usable detection signals that regenerate automatically, as stated in summary evidence. The many-to-one funnel plus the ordered detection lane and the scheduled-regeneration ticker are directly grounded in the readme claims (multiple suspicious indicator lists merged for detection, updates on a schedule). Detection Ledger reads the catalog as a static index but misses the 'collection into a usable detection' movement that is the repo's core offer; Red Blue Axis frames the value as an abstract spectrum that, while evocative, maps onto no evidence in the material and risks becoming decorative. Signal Aggregator also avoids the generic marketing defaults — no three-card wall, no shells — and produces a distinctive flowing figure that cannot be mistaken for a template. Its no-media strategy is safe because assetManifest is empty and remote images are disallowed.a:[["$","$20",null,{"enter":{"secondary-forward":"secondary-forward","secondary-back":"secondary-back-enter","default":"none"},"exit":{"secondary-forward":"secondary-forward","secondary-back":"secondary-back-exit","default":"none"},"update":{"secondary-forward":"secondary-forward","secondary-back":"secondary-back-update","default":"none"},"default":"none","children":["$","$L21","cmt2zh1p8015l627198ykap3p:zh-CN:beautified",{"project":{"id":"cmt2zh1p8015l627198ykap3p","slug":"mthcht-awesome-lists","name":"awesome-lists","description":"面向 SOC/CERT/CTI 的精选安全列表集合","authorName":"mthcht","authorVerification":{"verified":false,"verifiedAt":null},"category":"development_tools","subcategory":"data_ai_tools","experienceUrl":null,"qualityScore":36,"featured":false,"officialSite":null,"views":{"original":{"available":true},"official":{"available":false,"reason":"disabled_by_policy"},"beautified":{"available":true,"reason":null},"defaultView":"beautified"},"beautifiedView":{"revisionId":"cmt2zh1re015x6271so33r2yf","kind":"artifact","artifact":{"schemaVersion":"localized-static-html-v4","kind":"static_html","locales":["zh-CN","en"],"defaultLocale":"zh-CN","documents":{"zh-CN":"$22","en":"$23"},"designDirections":{"schemaVersion":"dodot-design-directions-v1","directions":[{"id":"detection-ledger","name":"Detection Ledger","projectMetaphor":"A curated library of curated security lists is a living index — a catalog of categories, each a row in a master register that SOC/CERT/CTI teams consult and re-verify.","signatureVisual":"A ruled register column: category names (threat hunting, DFIR, IOC feeds, detection resources) listed as numbered ledger rows, each with a small density bar indicating how many linked items it aggregates.","heroGeometry":"A ledger sheet grid where one primary column is pinned, flowing downward into ranked rows of indicator categories, colored by domain (hunt / respond / detect).","sectionSequence":["ledger-index","categories-matrix","threat-hunting-guide","indicator-data-feed","dfir-arsenal","regeneration"],"surfaceModel":"Layered paper ledger: ruled baseline grid, register column headers fixed, stacked tabbed category pages with hairline borders; rows deepen tonal levels so one reads the catalog like a stock-ticker of threats.","palette":"Iodine ink and ledger cream: deep aubergine ink, pale ivory paper, alert red as the only saturated accent for 'live/updated' markers, neutral graphite for data rows.","typography":"Tabular, mono-leaning for indices and counts; compact grotesque for category titles; hairline rules between entries to reinforce registry cadence.","desktopComposition":"1440: asymmetric register with a persistent category index rail at left, main ledger column center, and a rotated running-indicator spine at right showing item counts per domain.","mobileTransformation":"390: the register rail collapses into a horizontal category scroller; the ledger rows become swipeable stacked index cards where density bars read vertically beside names.","mediaStrategy":"No media region; the ledger rows and density bars are the evidence-driven graphic, no screenshots or placeholder frames.","forbiddenPatterns":["three-card metric wall","terminal or dashboard shell","decorative grid used without anchoring to list rows"],"compositionFingerprint":"LedgerReg:leftIndexRail + centerRuledRows + rightRunningSpine, rowHighlightAccentAlertRed, paperIvoryGround"},{"id":"red-blue-axis","name":"Red Blue Axis","projectMetaphor":"Every curated security list exists on a spectrum of intent: red signals that imitate an attacker and blue signals that defend — the catalog is a tension line teams walk between the two.","signatureVisual":"A directional axis diagram where each listed category sits as a calibrated marker along a spectrum from 'adversary imitation' (red) to 'defensive detection' (blue), with a CM-and-purple overlap band for DFIR/CTI.","heroGeometry":"A diagonal split field divided by a sweeping axis curve; markers (nodes) distribute left-to-right by each list's blend of offensive vs defensive use before narrowing to a resolution point.","sectionSequence":["tension-origin","red-fields","blue-fields","overlap-dfir-cti","hunt-resolution","signal"],"surfaceModel":"Volumetric depth mapping instead of flat surfaces: nodes cast onto a tinted field whose saturation rises as you near the offensive or defensive pole; cards are barely-inset chips, not boxed cards.","palette":"Deep neutral page with two directional chromatic fields (crimson toward the red pole, cyan toward the blue pole); the overlap band resolves to a violet midpoint.","typography":"Expressive display for the poles, tight neutral for marker labels; contrast drives the tension narrative, not decorative flourishes.","desktopComposition":"1440: an immersive full-bleed axis with floating domain markers; a thin left legend and a resolution 'needle' that pins the page to its most balanced category.","mobileTransformation":"390: the axis rotates into a vertical stack of draggable-thumb markers whose pole-affinity is shown by a small gradient bar under each name; no horizontal scrolling of the map.","mediaStrategy":"No local assets; the red/blue axis and its markers are the sole graphic, built from category relations only.","forbiddenPatterns":["three-card metric wall","windowed terminal or browser shells","glow/particle fields used as filler"],"compositionFingerprint":"AxisRedBlue:immersiveFullBleedField + calibratedDomainMarkers + risingSaturationByPole + violetOverlapResolution"},{"id":"signal-aggregator","name":"Signal Aggregator","projectMetaphor":"The repo is a funnel that takes many scattered indicator sources (named pipes, TLDs, ASNs, Windows services, certificates) and coalesces them into one usable detection signal — collection into a single filtered feed.","signatureVisual":"A set-aggregation composition: multiple distinct incoming streams (each labeled with an indicator family) converge through a focused junction into a single ruled signal lane; a throughput marker shows the feed regenerates on schedule.","heroGeometry":"An inverted funnel mandala: several source streams up top converge to a narrow choke point, then expand once more into an ordered 'detectable' lane — a figure of many-to-one-to-many.","sectionSequence":["source-streams","funnel-junction","indicator-families","detection-lane","hunt-guides","dfir-tools","regeneration"],"surfaceModel":"Flow-graph surfaces: discrete stream strokes with beaded nodes, a dense junction band, then a stable ruled output lane; layers communicate order of processing rather than nesting.","palette":"Neutral observation ground (deep graph ink) with each indicator family assigned a distinct but desaturated hue; the output lane is treated with an alert-green 'ready' marker, red only where a family is 'live/updated'.","typography":"Monospace-leaning for stream names and counts, neutral sans for process labels; the funnel reads like a data pipeline legend.","desktopComposition":"1440: a wide pipeline read left-to-right — source stacks converge into a central junction node, expanding right into an ordered detection lane with a scheduled-regeneration ticker.","mobileTransformation":"390: the horizontal pipeline folds into a vertical cascade; streams stack as a column of source rows funneling to a single junction cell, then fanning below — one continuous scroll, no panning.","mediaStrategy":"No media region; the converging-stream graph is the evidence-driven signature, replacing any screenshot or placeholder.","forbiddenPatterns":["three-card metric wall","fake controls, input, or search shells","decorative streamline/pixel gloss without data meaning"],"compositionFingerprint":"SignalAggregator:manySourceStreams + funnelJunctionChoke + oneOrderedDetectionLane + regenerationTicker + alertGreenReadyMarker"}],"selectedDirectionId":"signal-aggregator","selectionRationale":"$24"},"designBrief":{"schemaVersion":"dodot-design-brief-v1","selectedDirectionId":"signal-aggregator","projectMetaphor":"The repo is a funnel that takes many scattered indicator sources (named pipes, TLDs, ASNs, Windows services, certificates) and coalesces them into one usable detection signal — collection into a single filtered feed.","signatureVisual":"A set-aggregation composition: multiple distinct incoming streams (each labeled with an indicator family) converge through a focused junction into a single ruled signal lane; a throughput marker shows the feed regenerates on schedule.","compositionFingerprint":"SignalAggregator:manySourceStreams + funnelJunctionChoke + oneOrderedDetectionLane + regenerationTicker + alertGreenReadyMarker","heroGeometry":"An inverted funnel mandala: several source streams up top converge to a narrow choke point, then expand once more into an ordered 'detectable' lane — a figure of many-to-one-to-many.","sectionSequence":["source-streams","funnel-junction","indicator-families","detection-lane","hunt-guides","dfir-tools","regeneration"],"surfaceModel":"Flow-graph surfaces: discrete stream strokes with beaded nodes, a dense junction band, then a stable ruled output lane; layers communicate order of processing rather than nesting.","palette":"Neutral observation ground (deep graph ink) with each indicator family assigned a distinct but desaturated hue; the output lane is treated with an alert-green 'ready' marker, red only where a family is 'live/updated'.","typography":"Monospace-leaning for stream names and counts, neutral sans for process labels; the funnel reads like a data pipeline legend.","desktopComposition":"1440: a wide pipeline read left-to-right — source stacks converge into a central junction node, expanding right into an ordered detection lane with a scheduled-regeneration ticker.","mobileTransformation":"390: the horizontal pipeline folds into a vertical cascade; streams stack as a column of source rows funneling to a single junction cell, then fanning below — one continuous scroll, no panning.","mediaStrategy":"No media region; the converging-stream graph is the evidence-driven signature, replacing any screenshot or placeholder.","evidencePlan":["Place the many-to-one funnel in the hero, labeling each source stream with a verified indicator family drawn from the summary (named pipes, TLDs, ASNs, Windows services, certificates) rather than invented metrics.","Ground the 'detection lane' copy in the repo description 'Awesome Security lists for SOC/CERT/CTI' and the summary claims for detection engineering, without quoting star counts as a headline.","Use the regeneration ticker to reflect the readme/summary claim that lists are updated automatically on a regular basis, expressed as cadence not fabricated dates.","Build the DFIR and hunt-guide sections only from the listed categories (threat hunting, DFIR, IOC feeds, detection resources), avoiding any tool names beyond those the summary explicitly names (Eric Zimmerman tools, Hayabusa, chainsaw)."],"localeContract":{"zh-CN":"为 SOC/DFIR 检测而精选的安全列表；把多个可疑指标族汇聚成可用的检测信号，并定期自动更新。","en":"Curated security lists for SOC/DFIR detections; coalesce many suspicious indicator families into one usable detection signal, regenerated on a reliable cadence."},"forbiddenPatterns":["Large generic slogan followed by exactly three metric cards","Terminal, dashboard, browser, or editor shells without direct project evidence","Fake inputs, search, switches, or control UI","Decorative gradients, glows, grids, or particle fields used as a substitute for the funnel figure","Desktop columns merely stacked on mobile without recomposition","Composition fingerprint, signature visual, or section sequence repeated from material.json.antiTemplateContext"]},"visualReview":{"schemaVersion":"dodot-automated-design-review-v1","status":"approved","summary":"页面忠实实现了 Signal Aggregator 方向：7 个 section 与 brief 的 sectionSequence 完全一致，hero 中出现的签名视觉是五类专业指标流（命名管道、TLD/域名、ASN、Windows 服务、证书）经漏斗节点收束为有序检测带并带再生节奏指示的 SVG 汇聚图；所有指标族、DFIR 工具（Eric Zimmerman、Hayabusa、chainsaw）、Windows ASR、勒索软件扩展名与勒索信文件名均直接取自 summary 材料，无星号数作头条，再生以节奏而非捏造日期呈现；手机断点对 lane-row 用 grid 区域重排、将 conv 链路折为纵向↓、split 收为单列，形成真重构而非简单堆叠；双语内容等价格式、数量与结构，均自然。未回退到通用 Hero/三卡/卡片墙，无终端/浏览器外壳、无假控件、无装饰性渐变网格。","checks":{"projectFit":{"passed":true,"evidence":"7 个 data-dodot-section 顺序为 source-streams, funnel-junction, indicator-families, detection-lane, hunt-guides, dfir-tools, regeneration，与 design-brief.json sectionSequence 逐项一致，处于 4-7 区间；hero 签名图、漏斗收束、检测带、更新节奏均扣合 'signal-aggregator' 方向的项目专属机制。"},"evidenceBound":{"passed":true,"evidence":"五类指标族（命名管道、TLD、ASN、Windows 服务、证书）取自 summary 第 2 条 claim；DFIR 工具仅列 Eric Zimmerman tools、Hayabusa、chainsaw 且与 summary 第 5 条 claim 一致；Windows ASR 规则、勒索软件扩展名与勒索信文件名出自 summary 第 4 条 claim；description 'Awesome Security lists for SOC/CERT/CTI' 被用作 detection-lane 文案；再生文案表达 'automatic · regular schedule' 的节奏，未捏造具体时间点，全文未把星号数用作头条。"},"signatureVisual":{"passed":true,"evidence":"zh-CN.html:210-240 / en.html:222-258 的 SVG 漏斗图为真实存在的签名视觉：五条彩色入站流（标有 named pipes/TLDs/ASNs/Windows/services/certificates）汇聚于 (420,300) 焦点漏斗节点，再向右扩展为三条有序检测带，附 'ordered detection lane' 标注，符合 brief.signatureVisual 描述；流色与 palette（各指标族去饱和色、输出带 alert-green ready、live 红色点）一致，无占位或截图。"},"mobileTransformation":{"passed":true,"evidence":"max-width:900px 下 lane-row 用 grid-template-areas 重排 idx/lab/use、split 收单列；max-width:520px 下 hero-rule 纵向、conv 处理链路改为纵向↓箭头把横向管道折为纵向级联；funnel SVG 以 preserveAspectRatio 等比缩放不产生横向溢出（QA scrollWidth=390=clientWidth，无横向滚动）。属于真重构而非仅堆叠列，满足 brief.mobileTransformation。"},"localeParity":{"passed":true,"evidence":"zh-CN.html 与 en.html 均含 h1=1、h2=6、section=7、同一 sectionSequence，文案逐节对等且两种语言均自然通顺；QA 统计 zh-CN cjk=1097、en latin=3669、cjk=0，句式与信息层级对称，无缺失章节。"},"antiTemplate":{"passed":true,"evidence":"无 'slogan+三张指标卡' 卡片墙；无终端/仪表盘/浏览器/编辑器外壳；无假输入/搜索/开关/控件；无装饰性渐变/发光/粒子作为漏斗图替代（regen-tick 的 alert-green 呼吸点是再生态势标记，有材料依据）；material.json.antiTemplateContext 为空，未复用任何既有组合指纹或签名视觉。"},"noFakeUi":{"passed":true,"evidence":"全文无 input/button/form/select/role=button（QA fakeControlCount=0）；regen-tick 的 live 脉冲仅是状态指示非可交互控件；conv 使用 role=list/listitem 表达处理链路语义而非伪造操作界面；均带 aria-label，无假 UI。"}},"issues":[]},"repairEvidence":[],"provenance":{"executor":"opencode","model":"deepseek/deepseek-v4-flash","opencodeVersion":"1.1.58","promptVersion":"dodot-showcase-deepseek-v4","inputHash":"3b17ad952111b718e4fe9320bc72124ee47e64e7f7c464890e847c288fc2825f","artifactHash":"a46d835ab59d4a35d6ec8ad573f1b8fa8049bfbc17b91a7f4246922f59fd56a7","designSkill":"dodot-showcase-design"},"qaEvidence":{"zh-CN":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1806,"cjkCount":1097,"latinLetterCount":334,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":6138,"h1Top":149,"bottomInset":215.3125,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"bc569004507e401979aecabbaef8694c0cc775baa4441a7daf1d2dbb895c7c75","middle":"1a869ee8d62ea5a5d1c816a6ad0e46e0a2a124d45469c9d59c666fea951db7dd","bottom":"6ec133f5e8f678c6e98408a1538b4a4f35690c99f0d6be26d0f8dd1917d28b21"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1806,"cjkCount":1097,"latinLetterCount":334,"scrollWidth":390,"clientWidth":390,"scrollHeight":6817,"h1Top":149,"bottomInset":215.4375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"8966af4db8327e86263547511d39b40f0609cb2719de5c74b28e282761318215","middle":"c2266602b50a0f16aee806561f587b2ccd6c593de2bd0aeff5802abddb966f21","bottom":"a5201e292f158403703b71152d0e8d13e035d2fa6d94ed66f5acbed4ffba8b59"},"consoleErrors":[],"networkRequests":[]}],"en":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":4486,"cjkCount":0,"latinLetterCount":3669,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":6489,"h1Top":151.1875,"bottomInset":214.53125,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"47bfb9817877c695a85eff5cb7bf0eee64063d582dffa0fbcb791f16dfc62a63","middle":"2ddf9e18f0bbba9b9ecc8528168997263ea38fad531c70a0a59691c24d8578aa","bottom":"9d0d932d7f481683ae71720449f48fc50dd2f061d35be7545b10d193512e3334"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":4486,"cjkCount":0,"latinLetterCount":3669,"scrollWidth":390,"clientWidth":390,"scrollHeight":7298,"h1Top":151.1875,"bottomInset":236.65625,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"64512bff53b01de1c711e5e23c63e8bb9c1be223ca85c0c55718a1a0c2fa517b","middle":"1999b7673de72b42706b1427a1a61a4f5b14608bd78052750cc3f45c0f5d0447","bottom":"7ccad0b3e71e1e8ee81d600632e9dc6ea70de1d94f775344bab50ef4405595f6"},"consoleErrors":[],"networkRequests":[]}]}},"generatorVersion":"opencode-1.1.58:deepseek/deepseek-v4-flash:dodot-showcase-deepseek-v4","publishedAt":"2026-08-20T07:19:07.491Z"},"rawExtraction":{"projectRevisionId":"cmt2zh1r3015r62710fct9a0j","projectVersion":1,"sources":[{"canonicalKey":"github:mthcht/awesome-lists","role":"primary","revisionVersion":1,"url":"https://github.com/mthcht/awesome-lists"}],"facts":[{"key":"repository_owner","value":"mthcht","evidence":[{"path":"repository.owner","excerpt":"mthcht"}]},{"key":"repository_name","value":"awesome-lists","evidence":[{"path":"repository.name","excerpt":"awesome-lists"}]},{"key":"description","value":"Awesome Security lists for SOC/CERT/CTI","evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]},{"key":"primary_language","value":"YARA","evidence":[{"path":"repository.language","excerpt":"YARA"}]},{"key":"license","value":"MIT","evidence":[{"path":"repository.license","excerpt":"MIT"}]},{"key":"topics","value":"awesome-list, blueteam, blueteam-tools, cti, detection, detection-engineering, dfir, hacktools, incident-response, ioc, iocs, ir, ransomware, redteam, rmm, security, siem, soc, threat-hunting, threat-intelligence","evidence":[{"path":"repository.topics","excerpt":"awesome-list, blueteam, blueteam-tools, cti, detection, detection-engineering, dfir, hacktools, incident-response, ioc, iocs, ir, ransomware, redteam, rmm, security, siem, soc, threat-hunting, threat-intelligence"}]},{"key":"source_count","value":"1","evidence":[{"path":"projectRevision.sources","excerpt":"github:mthcht/awesome-lists"}]}],"taxonomy":{"category":"development_tools","subcategory":"data_ai_tools","confidence":0.55,"evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]},"lifecycle":{"stage":"prototype","confidence":0.55,"evidence":[{"path":"readmeExcerpt","excerpt":"# Security lists for SOC/DFIR detections [![Awesome](https://awesome.re/badge.svg)](https://awesome.re) ![dt](https://github.com/mthcht/awesome-lists/assets/75267080/059432aa-cfe9-46d1-a611-fbb225bce66e) ## 🐾 Threat Hunting: - [ThreatHunting keywords Site](https://mthcht.github.io/ThreatHunting-Keywords/) - [ThreatHunting keywords Lists](https://github.com/mthcht/ThreatHunting-Keywords) - [ThreatHunting Yara rules](https://github.com/mthcht/ThreatHunting-Keywords-yara-rules) [ThreatHunting sear"}]},"userIntents":[{"slug":"build_software","label":"构建或改进软件","confidence":0.55,"evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]},{"slug":"automate_work","label":"自动化工作流程","confidence":0.55,"evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]},{"slug":"create_content","label":"创作内容或设计","confidence":0.55,"evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]},{"slug":"analyze_data","label":"分析与理解数据","confidence":0.55,"evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]},{"slug":"learn_explore","label":"学习与探索","confidence":0.55,"evidence":[{"path":"repository.description","excerpt":"Awesome Security lists for SOC/CERT/CTI"}]}],"readme":{"headings":["Security lists for SOC/DFIR detections [![Awesome](https://awesome.re/badge.svg)](https://awesome.re)","🐾 Threat Hunting:","📂 My Detection Lists","Other Lists","🛡️ DFIR:","🚫 IOC Feeds/Blacklists:","🐙 Github","🖥️ SIEM/SOC/PurpleTeam related:","📊 TI TTP/Framework/Model/Trackers","🕵️‍♂️ Investigation","📊 TI checks","🔬 Sandbox / Emulation","🧩 Data manipulation","📡 Detection Resources","🌐 Security News","📺 Youtube/Twitch channels","🎙️ Podcasts","💬 Discord /Slack channels","📚 Training","DFIR"],"commands":[]},"changeSet":[{"field":"repository","beforeHash":"ebb37ddaf16d76a4d2596a6f51419315337b2f3a5cb25d283e5587de55423a57","afterHash":"6ff08ef5572a5560e28991dfc9f3459bdeb131b31123d316fb3622cafdfb30b9"}]},"publishedAt":"2026-08-16T10:55:05.118Z","updatedAt":"2026-08-21T13:26:52.211Z","summary":{"id":"cmt2zh1r7015t627193h3cseb","projectType":"other","oneLine":"面向 SOC/CERT/CTI 的精选安全列表集合","overview":"这是一个面向安全运营中心（SOC）、CERT 和网络威胁情报（CTI）团队的精选安全列表仓库。它汇集了威胁狩猎、DFIR、检测工程等领域的资源，包括大量可疑指标列表（如命名管道、TLD、ASN、Windows 服务等）以及威胁狩猎指南和搜索示例。这些列表大多定期自动更新，适合用于检测规则开发和威胁狩猎实践。","highlights":["大量可疑指标列表","威胁狩猎指南","DFIR 工具资源","定期自动更新"],"bestFor":["SOC 分析师","威胁狩猎人员","检测工程师"],"caveats":["仓库树信息不完整，部分列表可能未列出","列表更新频率未明确，需自行验证时效性","部分资源为外部链接，需自行评估可靠性"],"categorySuggestion":"development_tools","subcategorySuggestion":"developer_resources","lifecycleStages":["testing_quality","deployment_growth"],"audienceIntents":["discover","build","operate"],"confidence":0.7,"evidence":[{"claim":"该仓库提供面向 SOC/CERT/CTI 的精选安全列表，涵盖威胁狩猎、DFIR、检测工程等主题。","sourceType":"description","locator":"https://github.com/mthcht/awesome-lists"},{"claim":"包含大量可疑指标列表，如可疑命名管道、TLD、ASN、Windows 服务、用户代理、证书等，并定期自动更新。","sourceType":"readme","locator":"https://github.com/mthcht/awesome-lists"},{"claim":"提供威胁狩猎指南和搜索示例，涵盖 Windows 服务、用户代理、DNS over HTTPS、可疑 TLD 等检测场景。","sourceType":"readme","locator":"https://github.com/mthcht/awesome-lists"},{"claim":"包含勒索软件已知文件扩展名和勒索信文件名列表，以及 Windows ASR 规则等检测资源。","sourceType":"readme","locator":"https://github.com/mthcht/awesome-lists"},{"claim":"提供 DFIR 工具和资源列表，如 Eric Zimmerman 工具、Hayabusa、chainsaw 等。","sourceType":"readme","locator":"https://github.com/mthcht/awesome-lists"},{"claim":"发布包含大文件的 release，并注明会定期更新。","sourceType":"release","locator":"https://github.com/mthcht/awesome-lists/releases/tag/big-files"}],"publishedAt":"2026-08-17T13:35:34.817Z"},"github":{"url":"https://github.com/mthcht/awesome-lists","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/75267080?v=4","starsCount":1858,"forksCount":226,"language":"YARA","syncedAt":"2026-08-17T13:33:28.960Z","license":"MIT","defaultBranch":"main","archived":false,"disabled":false,"lastChangedAt":"2026-08-17T13:29:15.000Z","missing":false},"tags":[],"updates":[]},"entryPoint":"discovery","claim":{"state":"unclaimed","verified":false},"initialView":"beautified","community":{"viewer":null,"state":{"likesCount":0,"creativeCount":0,"followersCount":0,"commentsCount":0,"liked":false,"creative":false,"followed":false},"comments":{"comments":[],"nextCursor":null}}}]}],"$L25"]