rustinel
karib0u/rustinelOpen-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
incident-responseioc-management
karib0u/rustinelOpen-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
crazy-max/windowsspyblockerBlock spying and tracking on Windows
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.
olafhartong/sysmon-modularA repository of sysmon configuration modules
joertx07/printnightmare-detection-labSplunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
karitamw/printnightmare-detection-mitigation-labSanitised Windows security lab demonstrating Active Directory administration, host and network detection, and layered mitigation of CVE-2021-34527.
manishrawat21/detection-rulesThis repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
trustedsec/sysmoncommunityguideTrustedSec Sysinternals Sysmon Community Guide
kjean13/aiagent-detection-rulesDetection rules for the Claude Code source leak : 16 Sigma rules, Splunk, Elastic, YARA. Lab-validated on GOAD Light DC02.
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
arisharazakhan-cpu/dod-blue-team-network-labHigh fidelity defensive security lab simulating a DoD aligned enterprise network with Active Directory, VLAN segmentation, STIG based hardening,…