APT-Hunter

APT-Hunter APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity . APT-Hunter use pre-defined detection rules and focus on statistics to uncover...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

Exploitarium-Detections

Exploitarium KQL Detection Coverage KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 202...

awesome-threat-detection

Awesome Threat Detection and Hunting A curated list of awesome threat detection and hunting resources Contents Threat Detection and Hunting 🔨 Tools Detection, Alerting and Automation Platforms Endpoint Monitoring Network Monitoring Email Monitoring 🔍 Detection Rules 📑 Dataset 📘 Resources Framewor...

Hunting-Queries-Detection-Rules

KQL Sentinel & Defender queries KQL for Defender XDR, Microsoft Sentinel & other Microsoft Solutions The purpose of this repository is to share KQL queries that can be used by anyone and are understandable. These queries are intended to increase detection coverage through the logs of Microsoft...

threat-research

This repository contains IoCs and YARA rules related to Threatray's threat research, which can be found here: https://www.threatray.com/blog For updates, research highlights, and analysis insights, follow us on X Twitter: https://x.com/ThreatrayLabs The repository is organized per post, which...

hunting-rules

Suricata Hunting Rules a.k.a. TGI HUNT Suricata rules to assist network anomaly detection. These rules are not performance focused and may perform poorly on high throughput networks. Requires Suricata version 7.0.3 or above. Feedback and suggestions are welcomed here. email blog...

MalwareTracesGenerator

MalwareTracesGenerator Generate malware traces for detection tests Report Bug · Request Feature 📋 Table of content 📋 Table of content 👀 About the project ❓ Why 🚀 Getting started ⚙️ Prerequisites 📦 Installation 🥷 Quick examples 👷 Contributing 🙌 Acknowledgments 📚 Licenses 👀 About the project...

auditd-attack

auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...

Sigma-Rules

Sigma-Rules Rules generated from our public reports are now directly contributed to the SigmaHQ project. You can find rules related to our reports using the following search. We also have a private Sigma ruleset for customers, if you are interested in a demo or access to the private rules please...

CVE-2026-41940-Detection

CVE-2026-41940 Detection Detection rules and log schemas for the cPanel/WHM authentication bypass CVE-2026-41940, by Unfold Security. Blog post: cPanel Exploit — CVE-2026-41940 Structure root@kitploit: ├── cpanelcve202641940malget.yml SIGMA rule — detects the CRLF injection request ├──...

sysmon-config

sysmon-config | A Sysmon configuration file This is a forked and modified version of @SwiftOnSecurity's sysmon config. It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

protections-artifacts

保護アーティファクト Elastic Security はランサムウェアやマルウェアを防止し、高度な脅威を検出し、レスポンダーに重要なコンテキストを提供します。無料でオープンソースであり、すべてのエンドポイントで利用可能です。 Protections-Artifacts は、Elastic Security for endpoint の検出ロジック（ルール、YARA など）を管理するリポジトリです。Elastic では、オープンかつ透過的であることが、私たちとユーザーの成功にとって重要であると考えています。詳細については、ブログ記事をご覧ください。 ディレクトリ...

detection-rules

检测规则 Detection Rules 是 Elastic Security 所用规则的大本营。该仓库用于 Elastic Security 检测引擎（Detection Engine）规则的开发、维护、测试、验证和发布。 该仓库最初在 Elastic 的博客文章中宣布：Elastic Security 开放公共检测规则仓库。更多内容，请参阅随附的网络研讨会：Elastic Security：公共检测规则仓库介绍。 目录 检测规则 目录 仓库概述 快速开始 如何贡献 检测即代码 DaC RTAs 许可证 疑问？问题？建议？ 仓库概述 Detection Rules...

CVE-2025-55182

CVE-2025-55182 Host-based detection rules for the RCE vulnerability in the React JavaScript framework...

Nuclei-Templates-Collection

https://github.com/0xSojalSec/templates-nuclei-Oracle-OAM---XSS https://gist.github.com/ResistanceIsUseless/e46848f67706a8aa1205c9d2866bff31 https://github.com/0xElkot/My-Nuclei-Templates https://github.com/0xSojalSec/Nuclei-Templates-API-Linkfinder https://github.com/0xSojalSec/templatesallnucle...

CVE-2021-31166-detection-rules

CVE-2021-31166 Detection Rules Different rules to detect if CVE-2021-31166 is being exploited Rules available: Suricata Snort The snort rules also work on suricata. Zeek To Do: Make PCAPs available which where used during the development of the signatures Zeek script Detection when the...

Sigma_rules

Sigmarules Random sigma rules to share with the community All rules are made by me. Research is referenced in the rules...

CVE-2021-44228-Log4Shell-Hashes

CVE-2021-44228-Log4Shell-Hashes Hashes for vulnerable LOG4J versions Created to help orgs search for this vulnerable versions https://www.lunasec.io/docs/blog/log4j-zero-day/ Source of the hashes: https://archive.apache.org/dist/logging/log4j/ Possibly 1.X affected...