detection-rules
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
anomaly-detectioncurated-resourcesdefensive-tools+3
2.7k
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
tsale/sigma_rulesSigma rules to share with the community
corelight/threat-hunting-guideStructured guide to threat hunting using Zeek logs, aligned with MITRE ATT&CK framework for proactive detection of adversary tactics and techniques.
anuththara2007-w/cve-2026-20127-exploit-extensionOffline browser extension providing defensive analysis and detection guidance for CVE-2026-20127, with packet visualization, IOC extraction, and…
mandiant/heyserialProgrammatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types
graylog2/graylog2-serverCentralized log management platform for collecting, indexing, and analyzing streaming logs, with alerting and event correlation for security…
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
hacklcx/hfishEnterprise-grade honeypot system for detecting internal network breaches, external threats, and producing threat intelligence with 90+ service…
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
snort3/snort3Multi-threaded network intrusion detection and prevention system with rule-based detection, protocol-aware inspection, and pcap analysis for…
withsecurelabs/doublepulsar-detection-scriptA python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
rfxn/linux-malware-detectMulti-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring,…
stamusnetworks/sciriusWeb interface for Suricata ruleset management, threat hunting, and rule tuning with multi-source feed aggregation, transformation, and activity…
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
dinotools/dionaeaLow-interaction honeypot that emulates vulnerable network services to capture malware, shellcode, and exploit attempts, with IPv6 and TLS support.
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.