Tools

immersive-labs-sec/bruteratel-detectiontools

A collection of Tools and Rules for decoding Brute Ratel C4 badgers

gossithedog/threathunting

Hunts for potential malware downloads and suspicious domain calls via common Windows LOLBins using YARA rules and Nexthink telemetry modules.

gendigitalinc/ioc

A continuously updated collection of threat intelligence indicators of compromise (IOCs), including YARA rules, for detecting and tracking malware…

bartblaze/yara-rules

Collection of private Yara rules.

embee-research/yara-detection-rules

Yara Rules for Modern Malware

nccgroup/yaml2yara

Generate bulk YARA rules from YAML input

synacktiv/synacktiv-rules

Public repository of Sigma and YARA rules created by Synacktiv

jas502n/cs_yara

check cs yara rules

jhatchi/nexacorp-dfir-inc-2026-001

DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement…

sumidcyber/zeroscout

🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…

malvuln/sigint-hombre

Dynamically generated Suricata rules from real-time threat feeds

insomnisec/detections-cve-2026-31431

Detection rules for CVE-2026-31431 Linux LPE Vulnerability - Credit: (Copy Fail) https://copy.fail

techwithorgito/cve-2025-55182-researching-process

Defensive research repository for CVE-2025-55182 (Pre-Auth RCE in React Server Components/Next.js). Includes technical analysis, detection rules…

runreveal/sigmalite

Go library for parsing and executing Sigma detection rules against log entries, supporting field modifiers, CIDR matching, and custom field resolvers…

hullabrian/eventhorizon

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

ethan-andrews/exploitarium-detections

KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of…