Repository Index

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

Sysmon configuration file template with default high-quality event tracing

• sysmon
• threatintel
• threat-hunting
• sysinternals

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Investigate suspicious activity by visualizing Sysmon's event log

• security
• kibana
• elasticsearch
• sysmon