Elemental

Elemental Elemental is a centralized threat library of MITRE ATT&CK techniques, Atomic Red Team tests, and over 280 Sigma rules. It provides an alternative way to explore the ATT&CK dataset, mapping relevant Atomic Red Team tests and Sigma rules to their respective technique. Elemental allows...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

owLSM

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities KEV catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow:...

Live-Forensicator

🛡️ Forensicator 🛡️ Cross-platform Incident Response & Live Forensics Toolkit Windows PowerShell | Linux Bash | macOS Shell Built for fast, structured, and actionable forensic investigations. 🤔 About Forensicator is a cross-platform incident response and live forensics toolkit. It is designed to...

sigma-ai

AgentShield Sigma Rules What is This Repository? This repository contains detection rules that help identify when an AI agent is being attacked or manipulated. Think of it as a library of "threat signatures" -- each rule describes a pattern that, when matched against an agent's log data, signals...

auditd

root@kitploit: / | / // / / /| |/ / / / / / / / / / // / // / / // // / // |,/,///,/ Best Practice Auditd Configuration Idea The idea of this auditd configuration is to provide a best-practice baseline that is designed to load out-of-the-box on major Linux distributions covers a broad set of...

threat-intel

threat-intel 本仓库包含补充材料，包括 Huntress 博客文章及其他媒体中讨论的 IOC 和签名。 组织结构 本仓库按年份组织，在相应的年份文件夹内会有一个以月份和该媒体标题命名的子文件夹，其内容为该媒体的配套材料。例如： root@kitploit: 2022 └── 2022-12 └── 28-TITLE └── detections └── sigma └── tools └── misc 对于这些补充文件的正确性或其他任何方面，均不提供任何保证。它们按 MIT 许可证发布，按原样提供。...

EventHorizon

EventHorizon EventHorizon is a tool meant to arm security analysts and/or researchers with Event Tracing for Windows ETW telemetry that, coupled with sigma-like rules, allow for robust endpoint detection and response capabilities. That being said, EventHorizon is in no way a replacement for prope...

SecFlow

SecFlow Fully Automated Multi-Vector Threat Analysis Pipeline Drop in any file, URL, IP, domain, or image. SecFlow routes it through specialized analyzers, reasons about findings with AI, and produces a professional security report with YARA rules, SIGMA rules, and exportable PDF — automatically...

sigma-cli

Sigma 命令行界面 这是使用 pySigma 库来管理、列出并将 Sigma 规则转换为查询语言的 Sigma 命令行界面。 入门 安装 安装 Sigma CLI 最简单的方式是通过 pipx 或 pip 。为此，请运行以下任一命令： root@kitploit: python -m pipx install sigma-cli python -m pip install sigma-cli 在 macOS 上使用 root@kitploit: python3 -m pip install sigma-cli root@kitploit: brew install sigma-cli...

synacktiv-rules

synacktiv-rules 由 Synacktiv 创建的 Sigma 与 YARA/YARA-X 规则公共仓库。 本仓库中的所有规则均应视为标记为 TLP:CLEAR 和 PAP:CLEAR 。 前提条件 使用 Sigma 规则时，请确保按照 logsource 字段中的定义收集并正确解析所需日志。 大多数用于检测的 Sigma 规则均为关联规则（Correlation Rules） ，如 Sigma 文档中所定义，以限制误报。这意味着对 SIEM / 后端支持有限。 所有 YARA 规则仅针对 YARA-X 构建和测试。这意味着，尽管非常罕见，但与 YARA...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

pySigma-backend-opensearch

pySigma OpenSearch 后端 这是 pySigma 的 OpenSearch 后端。它提供 sigma.backends.opensearch 包，包含两个后端类： OpensearchLuceneBackend - 将 Sigma 规则转换为 Lucene 查询语法 OpenSearchPPLBackend - 将 Sigma 规则转换为 PPL（管道处理语言）查询 Lucene 后端 Lucene 后端支持以下输出格式： default：纯 Lucene 语法的 OpenSearch 查询 提示： 在 Dashboard 中，您需要从 DQL 切换为 Lucene...

BloodSOCer

BloodSOCer BloodSOCer es una herramienta de automatización en Python que agrega datos de inteligencia de amenazas de múltiples fuentes Mitre ATT&CK, reglas Sigma, Atomic Red Team y genera archivos JSON para ingerir en BloodHound en formato OpenGraph. BloodSOCer también puede subir los archivos a...

leonidas

Leonidas This is the repository containing Leonidas, a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into:...

Sigma-Rules

Sigma-Rules 我们公开报告中生成的规则现已直接贡献给 SigmaHQ 项目。 您可以通过以下搜索找到与我们的报告相关的规则。 我们还为客户提供私有 Sigma 规则集，如果您对演示或访问私有规则感兴趣，请通过 https://thedfirreport.com/contact/ 联系我们。...

pySigma

pySigma pySigma 是一个将 Sigma 规则解析并转换为查询的 Python 库。它取代了传统 Sigma 工具链（sigmac），设计更为简洁，且几乎经过了全面测试。将规则转换为查询语言的后端，以及将规则转换到日志数据模型的处理管道，均被拆分到独立项目中，以保持 pySigma 本身精简且与厂商无关。请参阅下方 相关项目 部分以获取概览。 快速开始 要开始使用 pySigma，您需要 Python 3.10 或更高版本。使用您选择的 Python 包管理器进行安装。示例： root@kitploit: pip install pysigma pipenv install...