sigmalite

github.com/runreveal/sigmalite Package sigmalite provides a parser and an execution engine for the Sigma detection format. rule, err := sigmalite.ParseRulebyte title: My example rule detection: keywords: - foo - bar selection: EventId: 1234 condition: keywords and selection if err != nil return e...

Zircolite

Standalone Sigma-based detection for EVTX, Auditd, Sysmon for Linux, XML, CSV and JSON logs Zircolite runs Sigma rules over your logs. It flattens events into SQLite, turns each rule into an SQL query and reports what matches, offline, in one command. Many log formats , detected automatically:...

cve-2023-23397-purple-team

CVE-2023-23397 — Purple Team: Exploit + Detection Two halves of one project against the same Outlook NTLM-leak vulnerability CVE-2023-23397: Red team done: phishing delivery + exploitation of CVE-2023-23397 against a Windows 10 victim VM, full writeup in FINALPROJECTREPORT.pdf, walkthrough in...

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for...

GraySentinel-DSOU-45Day-2026

GraySentinel DSOU — Day 1: The Zero-Day Discovery Blue Team...

briefr — Updated!

BRIEFR Self-hosted CVE intelligence for analysts who need answers, not another raw feed Live demo · Documentation · Quick start · Screenshots What is BRIEFR? BRIEFR is a self-hosted CVE intelligence dashboard. It pulls public vulnerability and threat feeds into your PostgreSQL database, then give...

chainsaw v2.16.4

Rapidly Search and Hunt through Windows Forensic Artefacts Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for...

Zircolite v3.8.1

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...

Zircolite v3.8.0

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...