sublime-rules
sublime-security/sublime-rulesOpen-source YAML rule set for detecting and preventing email attacks including BEC, credential phishing, malware, and supporting threat hunting.
defensive-toolsemail-securityphishing+1
371
sublime-security/sublime-rulesOpen-source YAML rule set for detecting and preventing email attacks including BEC, credential phishing, malware, and supporting threat hunting.
olafhartong/mde-auditcheckMDE relies on some of the Audit settings to be enabled
olafhartong/sysmon-modularA repository of sysmon configuration modules
alt3kx/wafparan01d3Quick WAF "paranoid" Doctor Evaluation | WAFPARAN01D3 Tool
eclecticiq/opentaxiiTAXII server implementation in Python from EclecticIQ
corelight/corelightforsentineloneCorelight Dashboards and Parsers for Sentinel One Singularity
inverse-inc/packetfencePacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…
sap/macos-enterprise-privilegesThis application gives Mac users in enterprise environments control over the administration of their machines by elevating their access level to…
googleprojectzero/sandbox-attacksurface-analysis-toolsSet of tools to analyze Windows sandboxes for exposed attack surface.
twosevenonet/edrchokerA tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.
maxwitat/cve-2023-36884-scripts-for-intune-remediation-sccm-compliance-baselineThe remediation script should set the reg entries described in https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 . The detection…
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections
neo23x0/auditdBest Practice Auditd Configuration
corazawaf/corazaGo-based Web Application Firewall library compatible with ModSecurity SecLang rules and OWASP Core Rule Set v4, providing real-time HTTP traffic…
bfuzzy/auditd-attackA Linux Auditd rule set mapped to MITRE's Attack Framework
ossf/allstarGitHub App to set and enforce security policies
huntandhackett/concealed_code_executionTools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows
itm4n/pplcontrolWindows tool to list, get, set, protect, and unprotect process protection levels (PP/L) for debugging, inspection, and privilege escalation.