Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities KEV catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow:...

pySigma

pySigma pySigma is a python library that parses and converts Sigma rules into queries. It is a replacement for the legacy Sigma toolchain sigmac with a much cleaner design and is almost fully tested. Backends for support of conversion into query languages and processing pipelines for transforming...

Zircolite

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...

threat-intel

threat-intel This repository contains supplemental items including IOCs, and signatures discussed in Huntress blogposts, and other media. Organization This repository is organized by year, within that folder will be a subfolder named by the month and title of the media which is supported by its...

auditd

root@kitploit: / | / // / / /| |/ / / / / / / / / / // / // / / // // / // |,/,///,/ Best Practice Auditd Configuration Idea The idea of this auditd configuration is to provide a best-practice baseline that is designed to load out-of-the-box on major Linux distributions covers a broad set of...

Analysis

Detection Engineering Notes and Analysis This repository documents hands on detection research based on lab testing, log analysis, and real SOC workflows. The focus is on how attacker techniques actually appear in logs, what detection logic works in practice, what fails, and where false positives...

BloodSOCer

BloodSOCer BloodSOCer is a Python automation tool that aggregates threat intelligence data from multiple sources Mitre ATT&CK, Sigma rules, Atomic Red Team and produces JSON files to ingest in BloodHound in OpenGraph format. BloodSOCer can also upload the files to BloodHound and set the icons for...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

Live-Forensicator

🛡️ Forensicator 🛡️ Kit multiplataforma de respuesta a incidentes y forensia en vivo Windows PowerShell | Linux Bash | macOS Shell Diseñado para investigaciones forenses rápidas, estructuradas y accionables. 🤔 Acerca de Forensicator es un kit multiplataforma de respuesta a incidentes y forensia en...

sigma-cli

Sigma Command Line Interface This is the Sigma command line interface using the pySigma library to manage, list and convert Sigma rules into query languages. Getting Started Installation The easiest way to install the Sigma CLI is via pipx or pip. For this purpose run one of the following:...

EventHorizon

EventHorizon EventHorizon is a tool meant to arm security analysts and/or researchers with Event Tracing for Windows ETW telemetry that, coupled with sigma-like rules, allow for robust endpoint detection and response capabilities. That being said, EventHorizon is in no way a replacement for prope...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Bring your detection content, monitor your endpoints, and send alerts to the...

synacktiv-rules

synacktiv-rules Public repository of Sigma and YARA/YARA-X rules created by Synacktiv. All rules in this repository should be considered tagged as TLP:CLEAR and PAP:CLEAR. Prerequisites When using a Sigma rule, please make sure that you collect and correctly parse required logs as defined in the...

SecFlow

SecFlow Fully Automated Multi-Vector Threat Analysis Pipeline Drop in any file, URL, IP, domain, or image. SecFlow routes it through specialized analyzers, reasons about findings with AI, and produces a professional security report with YARA rules, SIGMA rules, and exportable PDF — automatically...

hayabusa

Generador rápido de líneas de tiempo forenses de registros de eventos de Windows y herramienta de caza de amenazas. Escrito en Rust seguro en memoria por Yamato Security — la única herramienta de código abierto con soporte completo de Sigma, incluyendo reglas de correlación v2...

WELA

WELA Analizador de Registros de Eventos de Windows ゑ羅 Una herramienta para auditar la configuración de los registros de eventos de Windows. Creado por Yamato Security — asegúrate de que estás registrando realmente los eventos que importan para DFIR...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

cve-2023-23397-purple-team

CVE-2023-23397 — Purple Team: Exploit + Detection Two halves of one project against the same Outlook NTLM-leak vulnerability CVE-2023-23397: Red team done: phishing delivery + exploitation of CVE-2023-23397 against a Windows 10 victim VM, full writeup in FINALPROJECTREPORT.pdf, walkthrough in...

Sigma-Rules

Sigma-Rules Rules generated from our public reports are now directly contributed to the SigmaHQ project. You can find rules related to our reports using the following search. We also have a private Sigma ruleset for customers, if you are interested in a demo or access to the private rules please...

pySigma-backend-opensearch

pySigma OpenSearch Backend This is the OpenSearch backend for pySigma. It provides the package sigma.backends.opensearch with two backend classes: OpensearchLuceneBackend - Converts Sigma rules to Lucene query syntax OpenSearchPPLBackend - Converts Sigma rules to PPL Piped Processing Language...