Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
Repository Index
55,140 visible repositories in the index
1–24 of 24 · Most stars
Malicious traffic detection system
A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.
BleachBit system cleaner for Windows and Linux
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
- bro
- scans
- nmap
- network
🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.
- cloudflare
- pentest-tool
- pentest
- censys
A pure Python HTML5 parser that just works. No C extensions to compile. No system dependencies to install. No complex API to learn.
SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.
- sip
- voip
- password-cracker
- svwar
in-toto is a framework to protect supply chain integrity.
- supply-chain
- security
- new-york-university
- secure-systems-lab
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
CrackQ: A Python Hashcat cracking queue system
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Laika BOSS: Object Scanning System
HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
- malware-analysis
- dynamic-analysis
- security
- linux
Charm: A Framework for Rapidly Prototyping Cryptosystems
- python
- cryptography
- prototyping
HAT (Hashcat Automation Tool) - An Automated Hashcat Tool for common wordlists and rules to speed up the process of cracking hashes during engagements. Created for Linux based systems
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
Fragscapy is a command-line tool to fuzz network protocols by automating the modification of outgoing network packets. It can run multiple successive tests to determine which options can be used to evade firewalls and IDS.
Intrusion Prevention System (IPS) for Secure Shell (SSH)
Multi-head SSH honeypot system.
User registration and login system for the Pyramid Web Framework.