sigmahq/pysigma-backend-opensearchConverts Sigma detection rules into OpenSearch Lucene and PPL queries, including alerting Monitor Rules and correlation support for SIEM detection…
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
gossithedog/threathuntingHunts for potential malware downloads and suspicious domain calls via common Windows LOLBins using YARA rules and Nexthink telemetry modules.
the-dfir-report/sigma-rulesRules generated from our investigations.
withsecurelabs/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
codextf2/cobaltstrike-sleepmask-yaraJust a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-…
thinkst/canarytokens-dockerDocker configuration to quickly setup your own Canarytokens.
gendigitalinc/iocA continuously updated collection of threat intelligence indicators of compromise (IOCs), including YARA rules, for detecting and tracking malware…
olafhartong/sysmon-modularA repository of sysmon configuration modules
singe/yellowA simple binary wrapper for DNS canarytokens.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
rfxn/linux-malware-detectMulti-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring,…
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
chainguard-dev/osquery-defense-kitProduction-ready detection & response queries for osquery
mbabinski/sigma-rulesA repository of my own Sigma detection rules.
bartblaze/yara-rulesCollection of private Yara rules.
