97 matches found
threat-research
This repository contains IoCs and YARA rules related to Threatray's threat research, which can be found here: https://www.threatray.com/blog For updates, research highlights, and analysis insights, follow us on X Twitter: https://x.com/ThreatrayLabs The repository is organized per post, which...
APT-Hunter
APT-Hunter APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity . APT-Hunter use pre-defined detection rules and focus on statistics to uncover...
Hunting-Queries-Detection-Rules
KQL Sentinel & Defender queries KQL for Defender XDR, Microsoft Sentinel & other Microsoft Solutions The purpose of this repository is to share KQL queries that can be used by anyone and are understandable. These queries are intended to increase detection coverage through the logs of Microsoft...
MalwareTracesGenerator
MalwareTracesGenerator Generate malware traces for detection tests Report Bug · Request Feature 📋 Table of content 📋 Table of content 👀 About the project ❓ Why 🚀 Getting started ⚙️ Prerequisites 📦 Installation 🥷 Quick examples 👷 Contributing 🙌 Acknowledgments 📚 Licenses 👀 About the project...
Security-Detections-MCP
Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...
auditd-attack
auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...
Exploitarium-Detections
Exploitarium KQL Detection Coverage KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 202...
sigma
Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...
awesome-threat-detection
Awesome Threat Detection and Hunting A curated list of awesome threat detection and hunting resources Contents Threat Detection and Hunting 🔨 Tools Detection, Alerting and Automation Platforms Endpoint Monitoring Network Monitoring Email Monitoring 🔍 Detection Rules 📑 Dataset 📘 Resources Framewor...
protections-artifacts
Artefactos de Protección Elastic Security previene ransomware y malware, detecta amenazas avanzadas y brinda a los respondedores un contexto vital. Es gratuito y abierto, listo para cada endpoint. Protections-Artifacts es el hogar de nuestra lógica de detección reglas, yara, etc. para Elastic...
detection-rules
Reglas de detección Detection Rules es el hogar de las reglas utilizadas por Elastic Security. Este repositorio se utiliza para el desarrollo, mantenimiento, pruebas, validación y publicación de reglas para el Motor de Detección de Elastic Security. Este repositorio se anunció por primera vez en ...
CVE-2021-31166-detection-rules
CVE-2021-31166 Detection Rules Different rules to detect if CVE-2021-31166 is being exploited Rules available: Suricata Snort The snort rules also work on suricata. Zeek To Do: Make PCAPs available which where used during the development of the signatures Zeek script Detection when the...
CVE-2025-55182
CVE-2025-55182 Reglas de detección basadas en el host para la vulnerabilidad RCE en el framework React JavaScript...
Sigma_rules
Sigmarules Random sigma rules to share with the community All rules are made by me. Research is referenced in the rules...
CVE-2021-44228-Log4Shell-Hashes
CVE-2021-44228-Log4Shell-Hashes Hashes for vulnerable LOG4J versions Created to help orgs search for this vulnerable versions https://www.lunasec.io/docs/blog/log4j-zero-day/ Source of the hashes: https://archive.apache.org/dist/logging/log4j/ Possibly 1.X affected...
hunting-rules
Suricata Hunting Rules a.k.a. TGI HUNT Suricata rules to assist network anomaly detection. These rules are not performance focused and may perform poorly on high throughput networks. Requires Suricata version 7.0.3 or above. Feedback and suggestions are welcomed here. email blog...
sysmon-config
sysmon-config | A Sysmon configuration file This is a forked and modified version of @SwiftOnSecurity's sysmon config. It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the...
YARA
Yara Repository of Yara rules I've come up with over time, mostly for learning purposes. Originally inspired by @greglesnewich HundredDaysOfYara challenge. I make no claims for this repository, use at your own risk. Huppy Hunting!...
Sigma-Rules
Sigma-Rules Rules generated from our public reports are now directly contributed to the SigmaHQ project. You can find rules related to our reports using the following search. We also have a private Sigma ruleset for customers, if you are interested in a demo or access to the private rules please...