iMonitorSDK
wecooperate/imonitorsdkThe world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能，…
configuration-auditingdefensive-toolsforensics+5
379
wecooperate/imonitorsdkThe world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能，…
swiftonsecurity/sysmon-configCommented Sysmon configuration template for high-quality Windows event tracing, threat hunting, and incident response. Designed as a tutorial for…
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
antonlovesdnb/sysmonconfigpusher2Web-based tool for managing and deploying Sysmon configurations across Windows endpoints via agentless (WMI/SMB) or agent-based methods, with remote…
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
arisharazakhan-cpu/dod-blue-team-network-labHigh fidelity defensive security lab simulating a DoD aligned enterprise network with Active Directory, VLAN segmentation, STIG based hardening,…
n0dec/malwlessTest Blue Team detections without running any attack.
yarox24/attack_monitorEndpoint detection & Malware analysis software
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
0xrawsec/whidsWindows EDR with Gene-based detection engine, real-time artifact collection, Sysmon integration, and REST API for managing endpoints, rules, and…
olafhartong/sysmon-modularA repository of sysmon configuration modules
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
iomoath/filewatchtowerFWT is a security analysis and file monitoring tool that utilizes Sysmon events.
kjean13/aiagent-detection-rulesDetection rules for the Claude Code source leak : 16 Sigma rules, Splunk, Elastic, YARA. Lab-validated on GOAD Light DC02.