EventHorizon

EventHorizon EventHorizon ist ein Tool, das Sicherheitsanalysten und/oder Forschern mit Event Tracing for Windows ETW-Telemetrie ausstatten soll, die in Verbindung mit sigma-ähnlichen Regeln robuste Endpunkterkennungs- und Reaktionsfähigkeiten ermöglicht. Allerdings ist EventHorizon keinesfalls e...

sigma-ai

AgentShield Sigma-Regeln Was ist dieses Repository? Dieses Repository enthält Erkennungsregeln, die dabei helfen, Angriffe oder Manipulationen an einem KI-Agenten zu identifizieren. Betrachten Sie es als eine Bibliothek von „Bedrohungssignaturen“ – jede Regel beschreibt ein Muster, das, wenn es m...

sigmalite

github.com/runreveal/sigmalite Das Paket sigmalite bietet einen Parser und eine Ausführungs-Engine für das Sigma detection format. root@kitploit: rule, err := sigmalite.ParseRulebyte title: My example rule detection: keywords: - foo - bar selection: EventId: 1234 condition: keywords and selection...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Pipeline a impatto zero che trasforma le CVE appena armamentizzate dal catalogo CISA Known Exploited Vulnerabilities KEV in regole di rilevamento Sigma pronte per la produzione, automaticamente, ogni settimana. Il problema Convertire manualmente una nuova voce K...

Sigma_rules

Sigmarules Regole sigma casuali da condividere con la community Tutte le regole sono fatte da me. La ricerca è citata nelle regole...

owLSM

🛡️ owLSM aspira a diventare lo standard di riferimento per la prevenzione e il rilevamento su Linux 🛡️ owLSM è un agente eBPF LSM che implementa un motore di regole Sigma stateful incentrato sulla prevenzione. Cos'è il progetto: owLSM si concentra su tre aspetti principali: 1 Capacità di...

Security-Detections-MCP

Security Detections MCP Ein MCP Model Context Protocol-Server, der LLMs ermöglicht, eine einheitliche Datenbank mit Sigma -, Splunk ESCU -, Elastic -, KQL -, Sublime - und CrowdStrike CQL -Sicherheitserkennungsregeln abzufragen. Neu hier? Starten Sie mit demSetup-Guide – behandelt macOS, Windows...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

rustinel

Rustinel Open-Source-Endpunkterkennung für Windows, Linux und macOS. Native Telemetrie für Sigma, YARA, IOC-Erkennung und SIEM-fähige Warnmeldungen. Geschrieben in Rust. Webseite | Dokumentation | Herunterladen | SIEM-Demos Schnellstart Rustinel wird mit Release-Archiven ausgeliefert, die eine...

Zircolite

Eigenständiges SIGMA-basiertes Erkennungstool für EVTX-, Auditd-, Sysmon-für-Linux-, XML-, CSV- oder JSONL/NDJSON-Logs Zircolite ist ein eigenständiges, in Python 3 geschriebenes Tool, mit dem Sie SIGMA-Regeln auf Folgendes anwenden können: MS-Windows-EVTX EVTX-, XML- und JSONL-Formate Auditd-Log...

Live-Forensicator

🛡️ Forensicator 🛡️ Toolkit per Incident Response e Forensica Live multipiattaforma Windows PowerShell | Linux Bash | macOS Shell Progettato per indagini forensi rapide, strutturate e utilizzabili. 🤔 Informazioni Forensicator è un toolkit multipiattaforma per incident response e forensica live. È...

LOLDrivers

LOLDrivers - Living Off The Land Drivers 🚗💨 Willkommen bei LOLDrivers Living Off The Land Drivers, einem spannenden Open-Source-Projekt, das verwundbare, bösartige und bekannte bösartige Windows-Treiber in einem umfassenden Repository zusammenführt. Unsere Mission ist es, Organisationen jeder Grö...

hayabusa

Generatore veloce di timeline forensi per log eventi Windows e strumento di threat hunting. Scritto in Rust memory-safe da Yamato Security — l'unico strumento open-source con supporto completo per Sigma, incluse le regole di correlazione v2. !https://img.shi...

WELA

WELA Analizzatore del registro eventi di Windows ゑ羅 Uno strumento per il controllo delle impostazioni del registro eventi di Windows. Creato da Yamato Security — assicurati di registrare effettivamente gli eventi che contano per la DFIR. 📖 Leggi la documentazione → Disponibile in 15 lingue —...

CVE-2026-64502

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

UBUNTU-CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

CVE-2026-64502

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

CVE-2026-64502

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

CVE-2026-64501 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...