Log Analysis

sigmahq/pysigma

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)

keyboardcrunch/sentinelone-attack-queries

MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity

mthcht/threathunting-keywords

Awesome list of keywords and artifacts for Threat Hunting sessions

cobalt-strike/sleep_python_bridge

This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need…

1-bit-wonder/kestrel

Single-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.

cristhiansm0/txdxcristhian_2023-cve-38831

CVE-2023-38831 WinRAR lab: detection with Sysmon/Wazuh, reverse engineering with Ghidra, patch analysis, and remediation.

joertx07/printnightmare-detection-lab

Splunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…

zephrfish/ludus-defender-lab

MDE/MDI Defender setup for Ludus

trustedsec/sysmoncommunityguide

TrustedSec Sysinternals Sysmon Community Guide

cisco-talos/deceive

DECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!

tsale/sigma_rules

Sigma rules to share with the community

nextronsystems/evtx-baseline

A repository hosting example goodware evtx logs containing sample software installation and basic user interaction

nextronsystems/sysmon-config

Provides curated Sysmon event-tracing configuration templates for detecting Cobalt Strike, webshells, ransomware artifacts, and known exploit…

lethal-forensics/memprocfs-analyzer

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

linux-audit/audit-kernel

GitHub mirror of the Linux Kernel's audit repository

freeguy-6/dmz-security-monitoring-hardening

CY376 Blue Team project — pfSense DMZ, Suricata IDS/IPS, and automated host hardening against CVE-2014-6271