102 matches found
CVE-2021-31166-detection-rules
CVE-2021-31166 Detection Rules Different rules to detect if CVE-2021-31166 is being exploited Rules available: Suricata Snort The snort rules also work on suricata. Zeek To Do: Make PCAPs available which where used during the development of the signatures Zeek script Detection when the...
auditd-attack
auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...
sysmon-config
sysmon-config | A Sysmon configuration file This is a forked and modified version of @SwiftOnSecurity's sysmon config. It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the...
Exploitarium-Detections
Exploitarium KQL Detection Coverage KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 202...
Sigma-Rules
Sigma-Rules Rules generated from our public reports are now directly contributed to the SigmaHQ project. You can find rules related to our reports using the following search. We also have a private Sigma ruleset for customers, if you are interested in a demo or access to the private rules please...
Nuclei-Templates-Collection
https://github.com/0xSojalSec/templates-nuclei-Oracle-OAM---XSS https://gist.github.com/ResistanceIsUseless/e46848f67706a8aa1205c9d2866bff31 https://github.com/0xElkot/My-Nuclei-Templates https://github.com/0xSojalSec/Nuclei-Templates-API-Linkfinder https://github.com/0xSojalSec/templatesallnucle...
APT-Hunter
APT-Hunter Threat hunting for Windows event logs, built with a purple-team mindset. APT-Hunter is a threat hunting tool for Windows event logs. It uses pre-defined detection rules and log statistics to surface APT activity hidden in large volumes of events, cutting the time needed to uncover...
MalwareTracesGenerator
MalwareTracesGenerator Generate malware traces for detection tests Report Bug · Request Feature 📋 Table of content 📋 Table of content 👀 About the project ❓ Why 🚀 Getting started ⚙️ Prerequisites 📦 Installation 🥷 Quick examples 👷 Contributing 🙌 Acknowledgments 📚 Licenses 👀 About the project...
protections-artifacts
Artefactos de Protección Elastic Security previene ransomware y malware, detecta amenazas avanzadas y brinda a los respondedores un contexto vital. Es gratuito y abierto, listo para cada endpoint. Protections-Artifacts es el hogar de nuestra lógica de detección reglas, yara, etc. para Elastic...
Security-Detections-MCP
Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...
threat-research
This repository contains IoCs and YARA rules related to Threatray's threat research, which can be found here: https://www.threatray.com/blog For updates, research highlights, and analysis insights, follow us on X Twitter: https://x.com/ThreatrayLabs The repository is organized per post, which...
sigma
Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...
Hunting-Queries-Detection-Rules
KQL Sentinel & Defender queries KQL for Defender XDR, Microsoft Sentinel & other Microsoft Solutions The purpose of this repository is to share KQL queries that can be used by anyone and are understandable. These queries are intended to increase detection coverage through the logs of Microsoft...
hunting-rules
Suricata Hunting Rules a.k.a. TGI HUNT Suricata rules to assist network anomaly detection. These rules are not performance focused and may perform poorly on high throughput networks. Requires Suricata version 7.0.3 or above. Feedback and suggestions are welcomed here. email blog...
awesome-threat-detection
Awesome Threat Detection and Hunting A curated list of awesome threat detection and hunting resources Contents Threat Detection and Hunting 🔨 Tools Detection, Alerting and Automation Platforms Endpoint Monitoring Network Monitoring Email Monitoring 🔍 Detection Rules 📑 Dataset 📘 Resources Framewor...
detection-rules
Reglas de detección Detection Rules es el hogar de las reglas utilizadas por Elastic Security. Este repositorio se utiliza para el desarrollo, mantenimiento, pruebas, validación y publicación de reglas para el Motor de Detección de Elastic Security. Este repositorio se anunció por primera vez en ...
Sigma_rules
Sigmarules Random sigma rules to share with the community All rules are made by me. Research is referenced in the rules...
CVE-2021-44228-Log4Shell-Hashes
CVE-2021-44228-Log4Shell-Hashes Hashes for vulnerable LOG4J versions Created to help orgs search for this vulnerable versions https://www.lunasec.io/docs/blog/log4j-zero-day/ Source of the hashes: https://archive.apache.org/dist/logging/log4j/ Possibly 1.X affected...
YARA
Yara Repository of Yara rules I've come up with over time, mostly for learning purposes. Originally inspired by @greglesnewich HundredDaysOfYara challenge. I make no claims for this repository, use at your own risk. Huppy Hunting!...