Hysen Labsawesome-lists
Awesome Security lists for SOC/CERT/CTI
Awesome security lists for SOC and DFIR
A curated collection of detection lists, YARA style rules and threat hunting keywords aimed at security operations, CERT and cyber threat intelligence teams.
What it covers
The repository is framed as a set of awesome security lists for SOC, DFIR and detection work. It links threat hunting keyword site and lists plus YARA rules, and then enumerates a large set of detection lists held in the Lists directory. These include suspicious named pipes, suspicious top level domains, suspicious autonomous system numbers, suspicious Windows services and scheduled tasks, suspicious destination ports, suspicious firewall rules, suspicious HTTP user agents, suspicious certificate signers, suspicious USB identifiers, suspicious mutex names, suspicious MAC addresses and suspicious hostnames. The breadth suggests the project is a practical reference for analysts building detections rather than a single rule pack.
Automation and sources
Several lists are noted as updated automatically, specifically the suspicious TLDs, suspicious ASNs and a Maxmind GeoIP database correlation. The README also links a series of threat hunting guides and detection writeups hosted on detect.fyi and the author's Medium, covering topics such as DNS over HTTPS, hijackable DLLs, phishing with dnstwist, browser extension installs, C2 hiding in plain sight, HTML smuggling, and event log time slipping. These external writeups contextualize how the lists are meant to be used in a SIEM or hunting platform.
Intent and license
The lists are presented as supporting security operations, digital forensics and incident response, and cyber threat intelligence detection. The repository is tagged as an awesome list and is MIT licensed. The dominant language is YARA, reflecting the rule and indicator focus, while many of the concrete indicators ship as CSV files under the Lists tree so they can be ingested into detection pipelines directly. The project is maintained as a reference collection rather than as a packaged product.
Editorial conclusion
The collection is MIT licensed and reported one thousand eight hundred eighty stars at indexing, written largely in YARA with CSV indicator files in the Lists directory.
Community notes