swiftonsecurity/sysmon-configCommented Sysmon configuration template for high-quality Windows event tracing, threat hunting, and incident response. Designed as a tutorial for…
crazy-max/windowsspyblockerBlock spying and tracking on Windows
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
olafhartong/sysmon-modularA repository of sysmon configuration modules
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
trustedsec/sysmoncommunityguideTrustedSec Sysinternals Sysmon Community Guide
0xrawsec/whidsWindows EDR with Gene-based detection engine, real-time artifact collection, Sysmon integration, and REST API for managing endpoints, rules, and…
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
bats3c/ghost-in-the-logsKernel-level tool to disable Sysmon and Windows Event Logging via driver-based hook injection, enabling stealthy post-exploitation operations on…
nextronsystems/sysmon-configSysmon configuration file template with default high-quality event tracing
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
karib0u/rustinelOpen-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
christophetd/adaz:wrench: Deploy customizable Active Directory labs in Azure - automatically.