WELA

WELA Windows Event Log Analyzer ゑ羅 A tool for auditing Windows event log settings. Created by Yamato Security — make sure you are actually recording the events that matter for DFIR. 📖 Read the Documentation → Available in 15 languages — English · 日本語 · 繁體中文 · 한국어 · Deutsch · Türkçe · Français ·...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

LOLDrivers

LOLDrivers - Living Off The Land Drivers 🚗💨 Welcome to LOLDrivers Living Off The Land Drivers, an exciting open-source project that brings together vulnerable, malicious, and known malicious Windows drivers in one comprehensive repository. Our mission is to empower organizations of all sizes with...

Zircolite

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...

auditd

root@kitploit: / | / // / / /| |/ / / / / / / / / / // / // / / // // / // |,/,///,/ Best Practice Auditd Configuration Idea The idea of this auditd configuration is to provide a best-practice baseline that is designed to load out-of-the-box on major Linux distributions covers a broad set of...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

Elemental

Elemental Elemental is a centralized threat library of MITRE ATT&CK techniques, Atomic Red Team tests, and over 280 Sigma rules. It provides an alternative way to explore the ATT&CK dataset, mapping relevant Atomic Red Team tests and Sigma rules to their respective technique. Elemental allows...

owLSM

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Bring your detection content, monitor your endpoints, and send alerts to the...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

sigmalite

github.com/runreveal/sigmalite Package sigmalite provides a parser and an execution engine for the Sigma detection format. root@kitploit: rule, err := sigmalite.ParseRulebyte title: My example rule detection: keywords: - foo - bar selection: EventId: 1234 condition: keywords and selection if err ...

Live-Forensicator

🛡️ Forensicator 🛡️ Cross-platform Incident Response & Live Forensics Toolkit Windows PowerShell | Linux Bash | macOS Shell Built for fast, structured, and actionable forensic investigations. 🤔 About Forensicator is a cross-platform incident response and live forensics toolkit. It is designed to...

leonidas

Leonidas This is the repository containing Leonidas, a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into:...

sigma-cli

Interfaz de línea de comandos de Sigma Esta es la interfaz de línea de comandos de Sigma que utiliza la librería pySigma para gestionar, listar y convertir reglas Sigma en lenguajes de consulta. Primeros pasos Instalación La forma más sencilla de instalar la CLI de Sigma es mediante pipx o pip...

SecFlow

SecFlow Fully Automated Multi-Vector Threat Analysis Pipeline Drop in any file, URL, IP, domain, or image. SecFlow routes it through specialized analyzers, reasons about findings with AI, and produces a professional security report with YARA rules, SIGMA rules, and exportable PDF — automatically...

pySigma-backend-opensearch

Backend de OpenSearch para pySigma Este es el backend de OpenSearch para pySigma. Proporciona el paquete sigma.backends.opensearch con dos clases de backend: OpensearchLuceneBackend - Convierte reglas Sigma a sintaxis de consulta Lucene OpenSearchPPLBackend - Convierte reglas Sigma a consultas...

EventHorizon

EventHorizon EventHorizon is a tool meant to arm security analysts and/or researchers with Event Tracing for Windows ETW telemetry that, coupled with sigma-like rules, allow for robust endpoint detection and response capabilities. That being said, EventHorizon is in no way a replacement for prope...

BloodSOCer

BloodSOCer BloodSOCer es una herramienta de automatización en Python que agrega datos de inteligencia de amenazas de múltiples fuentes Mitre ATT&CK, reglas Sigma, Atomic Red Team y genera archivos JSON para ingerir en BloodHound en formato OpenGraph. BloodSOCer también puede subir los archivos a...