crowdstrike-falcon-queries
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
anomaly-detectiondefensive-toolsintrusion-detection+1
220
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
nextronsystems/sysmon-configSysmon configuration file template with default high-quality event tracing
mthbernardes/artlasApache Real Time Logs Analyzer System
corelight/community-id-specAn open standard for hashing network flows into identifiers, a.k.a "Community IDs".
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
corelight/cve-2022-22954Zeek package that detects CVE-2022-22954 exploit attempts, logs exploit URIs and attacker response data to aid in incident response and network…
bartblaze/yara-rulesCollection of private Yara rules.
immersive-labs-sec/bruteratel-detectiontoolsA collection of Tools and Rules for decoding Brute Ratel C4 badgers
watchguard-threat-lab/log4shell-iocsA collection of IOCs for CVE-2021-44228 also known as Log4Shell
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
sifalcon/detectionCurated collection of detection rules and IOCs extracted from DFIR engagements and malware analyses to support threat hunting, incident response, and…
corelight/corelight-ansible-rolesCorelight-Ansible-Roles are a collection of Ansible Roles and playbooks that install, configure, run and manage a variety of Corelight, Suricata and…
thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…