51 matches found
EventHorizon
EventHorizon EventHorizon هي أداة مصممة لتزويد محللي الأمن و/أو الباحثين ببيانات تتبع أحداث Windows ETW والتي، إلى جانب قواعد تشبه قواعد Sigma، تتيح قدرات قوية للكشف والاستجابة على نقاط النهاية. ومع ذلك، فإن EventHorizon ليس بديلاً عن الحلول المناسبة بأي حال من الأحوال. يهدف هذا المشروع بشكل أساس...
sigma-ai
Regras Sigma do AgentShield O que é este repositório? Este repositório contém regras de deteção que ajudam a identificar quando um agente de IA está a ser atacado ou manipulado. Pense nisso como uma biblioteca de "assinaturas de ameaças" – cada regra descreve um padrão que, quando correspondido n...
SecFlow
SecFlow Vollautomatisierte Multi-Vektor-Bedrohungsanalyse-Pipeline Legen Sie jede Datei, URL, IP, Domain oder jedes Bild ab. SecFlow leitet sie durch spezialisierte Analysatoren, bewertet die Ergebnisse mit KI und erstellt automatisch einen professionellen Sicherheitsbericht mit YARA-Regeln,...
synacktiv-rules
synacktiv-rules Synacktiv द्वारा बनाए गए Sigma और YARA/YARA-X नियमों का सार्वजनिक भंडार repository। इस भंडार के सभी नियमों को TLP:CLEAR और PAP:CLEAR के रूप में टैग माना जाना चाहिए। पूर्वापेक्षाएँ Sigma नियम का उपयोग करते समय, कृपया सुनिश्चित करें कि आप logsource फ़ील्ड में परिभाषित आवश्यक लॉग एकत...
chainsaw
البحث والاصطياد السريع في الأدلة الجنائية لنظام ويندوز توفر Chainsaw قدرة «الاستجابة الأولية» first-response قوية لتحديد التهديدات بسرعة داخل الأدلة الجنائية لنظام ويندوز مثل سجلات الأحداث وملف MFT. كما توفر Chainsaw طريقة عامة وسريعة للبحث في سجلات الأحداث عن الكلمات المفتاحية، وتحديد التهديدات ...
Sigma
सिग्मा नियम हंट्रेस लैब्स में विकसित सिग्मा नियमों का एक संग्रह ट्विटर: https://twitter.com/embeeresearch https://twitter.com/HuntressLabs लाइसेंस नियम अनिवार्य रूप से बिना किसी प्रतिबंध के उपयोग करने के लिए स्वतंत्र हैं, बशर्ते कि उचित श्रेय बनाए रखा जाए लेखक/स्वामी आदि। डिटेक्शन रूल लाइसेंस DRL...
Sigma-Rules
Sigma-Rules Um repositório das minhas próprias regras de detecção Sigma...
EnableWindowsLogSettings
Guia da Yamato Security para Configuração do Log de Eventos do Windows para DFIR e Caça a Ameaças Inglês | 日本語 Este é mais um guia sobre como configurar e monitorar adequadamente os logs de eventos do Windows, com ênfase no registro de eventos para as regras do sigma. Este é um trabalho em...
detection-defense-library
डिटेक्शन डिफेंस लाइब्रेरी एक एकीकृत डिफेंस-इंजीनियरिंग लाइब्रेरी। Attack classes, उन्हें डिटेक्ट करने वाले पैटर्न, कमिट किए गए Sigma नियम, और Windows ट्रस्ट-बाउंड्री मॉडल — सभी एक ही रेपो में। यह रेपो चार पूर्व सहोदर रिपॉजिटरी को समेटता है:...
threat-intel
threat-intel Este repositório contém itens complementares, incluindo IOCs e assinaturas discutidos em postagens do blog da Huntress e outras mídias. Organização Este repositório é organizado por ano; dentro dessa pasta haverá uma subpasta nomeada pelo mês e pelo título da mídia cujo conteúdo é...
pySigma
pySigma pySigma é uma biblioteca Python que analisa e converte regras Sigma em consultas. É um substituto para a ferramenta Sigma legada sigmac com um design muito mais limpo e é quase totalmente testada. Os backends para suporte de conversão em linguagens de consulta e pipelines de processamento...
ExploitKnowdledgebase
poc2detect Defense-first pipeline that discovers GitHub proof...
From Attack Simulation to SIEM Rule: Deterministic Detection-As-Code Synthesis with Probe-Level Traceability
Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder. These Breach-and-Attack-Simulation BAS tools surface findings, but the security information and event management SIEM systems that watch production need detection rul...
Exploit for CVE-2026-31431
CVE-2026-31431 "Copy Fail" — Defensive Detection Package A pr...
ctf-writeups
ctf-writeups Retos de HTB, TryHackMe y DFIR — documentado...
Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps
We introduce the Cyber Defense Benchmark, a benchmark for measuring how well large language model LLM agents perform the core SOC analyst task of threat hunting: given a database of raw Windows event logs with no guided questions or hints, identify the exact timestamps of malicious events. The...
CTI-REALM: A new benchmark for end-to-end detection rule generation with AI agents
Excerpt: CTI-REALM is Microsoft’s open-source benchmark for evaluating AI agents on real-world detection engineering—turning cyber threat intelligence CTI into validated detections. Instead of measuring “CTI trivia,” CTI-REALM tests end-to-end workflows: reading threat reports, exploring telemetr...
CISA Releases Malware Analysis Report on Malicious Listener Targeting Ivanti Endpoint Manager Mobile Systems
Today, CISA released a Malware Analysis Report detailing the functionality of two sets of malware obtained from an organization compromised by cyber threat actors exploiting CVE-2025-4427link is external and CVE-2025-4428link is external in Ivanti Endpoint Manager Mobile Ivanti EPMM. The Malware...