DeTTECT
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
defensive-toolsscada-ics-securitymobile-security+4
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
olafhartong/sysmon-parserGenerates and maintains Azure Sentinel parser for Sysmon events, normalizing all Windows endpoint telemetry into a searchable log schema via…
mbabinski/sigma-rulesA repository of my own Sigma detection rules.
mattnotmax/cyberchef-recipesA list of cyber-chef recipes and curated links
scriptjunkie/fwallowerAnalyze Windows Firewall outbound blocks and selectively allow traffic
renich/paredLightweight, secure control plane & real-time web dashboard in Crystal for Linux firewalld and NetworkManager host security.
joesecurity/sigma-rulesSigma rules from Joe Security
goatmilkkk/tinyprocessorA post-processing script for TinyTracer
embee-research/sigmaA repository to release detection rules to the public
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
forensicxlab/vision-procmonA ProcessMonitor visualization application written in rust.
cisagov/untitledgoosetoolUntitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to…
t3l3m3try/threat_huntingSome Threat Hunting queries useful for blue teamers
paulsec/awesome-windows-domain-hardeningA curated list of awesome Security Hardening techniques for Windows.
mthcht/purpleteamPurpleteam scripts simulation & Detection - trigger events for SOC detections
cyb3rmik3/kql-threat-hunting-queriesA repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).