EventHorizon

EventHorizon EventHorizon is a tool meant to arm security analysts and/or researchers with Event Tracing for Windows ETW telemetry that, coupled with sigma-like rules, allow for robust endpoint detection and response capabilities. That being said, EventHorizon is in no way a replacement for prope...

Live-Forensicator

🛡️ Forensicator 🛡️ Cross-platform Incident Response & Live Forensics Toolkit Windows PowerShell | Linux Bash | macOS Shell Built for fast, structured, and actionable forensic investigations. 🤔 About Forensicator is a cross-platform incident response and live forensics toolkit. It is designed to...

auditd

root@kitploit: / | / // / / /| |/ / / / / / / / / / // / // / / // // / // |,/,///,/ Best Practice Auditd Configuration Idea The idea of this auditd configuration is to provide a best-practice baseline that is designed to load out-of-the-box on major Linux distributions covers a broad set of...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

SecFlow

SecFlow Fully Automated Multi-Vector Threat Analysis Pipeline Drop in any file, URL, IP, domain, or image. SecFlow routes it through specialized analyzers, reasons about findings with AI, and produces a professional security report with YARA rules, SIGMA rules, and exportable PDF — automatically...

Elemental

Elemental Elemental is a centralized threat library of MITRE ATT&CK techniques, Atomic Red Team tests, and over 280 Sigma rules. It provides an alternative way to explore the ATT&CK dataset, mapping relevant Atomic Red Team tests and Sigma rules to their respective technique. Elemental allows...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

detections

Detecciones Este repositorio sirve como hogar para el contenido de detección desarrollado por el equipo de delivr.to. Todas las reglas presentes en este repositorio tienen payloads correspondientes enlazados en las referencias y mostrados a continuación que pueden utilizarse para probar el...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

owLSM

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

BloodSOCer

BloodSOCer BloodSOCer es una herramienta de automatización en Python que agrega datos de inteligencia de amenazas de múltiples fuentes Mitre ATT&CK, reglas Sigma, Atomic Red Team y genera archivos JSON para ingerir en BloodHound en formato OpenGraph. BloodSOCer también puede subir los archivos a...

pySigma-backend-opensearch

Backend de OpenSearch para pySigma Este es el backend de OpenSearch para pySigma. Proporciona el paquete sigma.backends.opensearch con dos clases de backend: OpensearchLuceneBackend - Convierte reglas Sigma a sintaxis de consulta Lucene OpenSearchPPLBackend - Convierte reglas Sigma a consultas...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities KEV catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow:...

Sigma_rules

Sigmarules Reglas sigma aleatorias para compartir con la comunidad Todas las reglas están hechas por mí. La investigación está referenciada en las reglas...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

sigma-ai

AgentShield Sigma Rules What is This Repository? This repository contains detection rules that help identify when an AI agent is being attacked or manipulated. Think of it as a library of "threat signatures" -- each rule describes a pattern that, when matched against an agent's log data, signals...

Sigma-Rules

Sigma-Rules Las reglas generadas a partir de nuestros informes públicos ahora se contribuyen directamente al proyecto SigmaHQ. Puede encontrar las reglas relacionadas con nuestros informes utilizando la siguiente búsqueda. También tenemos un conjunto de reglas Sigma privado para clientes. Si le...

threat-intel

threat-intel Este repositorio contiene elementos complementarios, incluidos IOC y firmas discutidos en publicaciones de blog de Huntress y otros medios. Organización Este repositorio está organizado por año; dentro de esa carpeta habrá una subcarpeta nombrada por el mes y el título del medio al q...

pySigma

pySigma pySigma es una biblioteca de Python que analiza y convierte reglas Sigma en consultas. Es un reemplazo para la antigua cadena de herramientas Sigma sigmac con un diseño mucho más limpio y está casi totalmente probado. Los backends para soporte de conversión a lenguajes de consulta y los...