criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
joesecurity/sigma-rulesSigma rules from Joe Security
embee-research/sigmaA repository to release detection rules to the public
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
delivr-to/detectionsA home for detection content developed by the delivr.to team
t3l3m3try/threat_huntingSome Threat Hunting queries useful for blue teamers
connectedlucy/plagueDefault Detections for EDR
mthcht/purpleteamPurpleteam scripts simulation & Detection - trigger events for SOC detections
theflink/hunt-weird-syscallsETW based POC to identify direct and indirect syscalls
huntresslabs/threat-intelThis repository contains supplemental items including IOCs, and signatures discussed in Huntress blogposts, and other media.
theflink/hunt-weird-imageloadsSmall tool to play with IOCs caused by Imageload events
alwashali/detection-validationDetection rule validation
cyb3rmik3/kql-threat-hunting-queriesA repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
securepeacock/presentationsSlides and materials from conference presentations
yardenshafir/conference_talksSlides from various conference talks
cr0nx/awesome-linux-attack-forensics-purplelabsThis page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
sigmahq/pysigmaPython library to parse and convert Sigma rules into queries (and whatever else you could imagine)
