Skip to content

Back to the catalog

mthcht/awesome-lists
github.comrepo

mthcht/awesome-lists

mthcht/awesome-lists is a large, continually updated GitHub collection of threat-hunting IOC lists: suspicious named pipes, Windows services/tasks/firewall rules/ports, user-agents, mutex names, hostnames, MAC addresses, USB IDs, phishing/sinkholed/dyndns domains, HijackLibs, TOR node lists, LOLDrivers hashes, malicious bootloaders and SSL certificates, VPN provider IP ranges, YARA rules, offensive/greyware tool keyword detection patterns, Microsoft Defender/ClamAV signature lists, and RMM detection artifacts. It also links out to DFIR/threat-hunting courses, labs, and CTF-style datasets (SANS FOR500/FOR508, TheDFIRReport labs, Splunk BOTS, Xintra APT emulation) useful for blue teams building detections or hunting.

TL;DR Continually updated GitHub repo of security-relevant IOC lists (suspicious pipes, drivers, certs, domains, ASNs, YARA rules) plus DFIR/threat-hunting course and lab links.
Open original ↗
Document

What it is

mthcht/awesome-lists is a GitHub index of detection lists for threat hunting, mostly flat CSV files under the Lists folder. The README is a link table. It has no usage instructions, schema description or sample queries.

What the summary leaves out

Several lists go beyond the IOC types the catalog summary names:

  • Cloud and identity: microsoft_apps_list.csv (Microsoft App IDs for business email compromise detection), OAuth suspicious app IDs (OauthSentry), and a list of important roles, groups and permissions for AD, EntraID, AWS and Graph.
  • Extensions: suspicious browser extensions (extsentry) and suspicious VS Code extensions (vsxsentry).
  • Endpoint hardening and ransomware: windows_asr_rules.csv, ransomware_extensions_list.csv and ransomware_notes_list.csv.
  • Network context: suspicious TLDs and ASNs, dns_over_https_servers_list.csv, ip_location_sites_list.csv, a proxy IP/port list, company IP ranges (including Microsoft), and a MaxMind GeoIP database copy.
  • Domain lookalikes: DNSTwist default domain lists with a script.
  • Executable metadata: executables_metadata_informations_list.csv.

VPN coverage is four named providers: NordVPN, ProtonVPN, SurfShark and Mullvad. Each has its own CSV, for example mullvad_relay_servers_ips_list.csv.

What to do

Pull individual CSVs into SIEM lookups or watchlists instead of cloning the whole repo. The page marks these as updated automatically:

  • suspicious TLDs and ASNs
  • the GeoIP database
  • HijackLibs
  • TOR nodes
  • LOLDrivers hashes
  • malicious bootloader hashes
  • malicious SSL certificates
  • DNSTwist lists
  • VPN IP lists
  • company IP ranges
  • the bookmarks file

The README also links a bookmarks file for importing all list links into a browser.

Caveats

  • The README says most lists are updated after each tool analysed in the author's detection keywords project. Refresh cadence for lists without the "updated automatically" tag is unstated.
  • The page gives no provenance, false-positive guidance or format documentation. Greyware and offensive-tool keyword lists will need tuning before alerting.
  • The training section covers 13cubed, SANS FOR500, FOR508 and SANS555, TryHackMe SOC levels 1 and 2, LetsDefend, Splunk BOTS datasets v1 to v3, and Xintra labs. It is a reading list, not detection content.

Organisations named here

  • HijackLibs

Technologies named here

  • awesome-lists
  • OauthSentry
  • GeoIP DB
  • Browser Extensions list
  • vsxsentry
  • extsentry
  • microsoft_apps_list.csv
  • executables_metadata_informations_list.csv
  • dns_over_https_servers_list.csv
  • dyndns_list.csv
  • Phishing domains and urls list
  • sinkholed_domains.csv
  • SINKHOLED
  • hijacklibs_list.csv
  • TOR Nodes Lists
  • loldrivers_only_hashes_list.csv
  • malicious_bootloaders_only_hashes_list.csv
  • ssl_certificates_malicious_list.csv
  • RMM detection list
  • ransomware_extensions_list.csv
  • ransomware_notes_list.csv
  • windows_asr_rules.csv
  • DNSTWIST Lists
  • nordvpn_ips_list.csv
  • protonvpn_ip_list.csv
  • surfshark_vpn_servers_domains_and_ips_list.csv
  • mullvad_relay_servers_ips_list.csv
  • PROXIES list
  • Companies IP Range Lists
  • ip_location_sites_list.csv
  • YARA rules
  • offensive_tool_keywords.csv
  • greyware_tool_keyword.csv
  • signature_keyword.csv
  • Microsoft Defender AV signatures lists
  • ClamAV signatures lists
  • suspicious_windows_services_names_list.csv
  • suspicious_windows_tasks_list.csv
  • suspicious_ports_list.csv
  • suspicious_windows_firewall_rules_list.csv
  • suspicious_http_user_agents_list.csv
  • suspicious_usb_ids_list.csv
  • suspicious_mutex_names_list.csv
  • suspicious_mac_address_list.csv
  • suspicious_hostnames_list.csv
  • suspicious_named_pipe_list.csv
  • Splunk Boss Of The SOC
  • tryhackme SOC lvl 1
  • tryhackme SOC lvl 2
  • letsdefend.io
  • Constructing Defense
  • SANS FOR500
  • SANS FOR508
  • SANS SEC555
  • Defensive-security Linux-live-forensics
  • Mastering Windows Forensics
  • InsightEngineering Forensic Debugging
  • Arsenal Recon publicly-accessible-disk-images
  • Xintra APT Emulation Labs
  • Xintra Attacking and Defending Azure M365
  • TheDFIRReport dfir-labs
  • ACEresponder
  • binaryz0ne DFIR challenges
  • 13cubed - Investigating Windows Endpoints
  • 13cubed - Investigating Windows Memory
  • 13cubed - Investigating Linux Devices
  • YARA
  • Windows Defender
  • ClamAV
  • Tor
  • PowerShell
  • LOLDrivers

Related in Blue Team & Detection