Repository Index

:vertical_traffic_light: Block malicious crawlers with Cloudflare Firewall Rules

• cloudflare
• firewall
• user-agent
• firewall-rules

gonids is a library to parse IDS rules, with a focus primarily on Suricata rule compatibility. There is a discussion forum available that you can join on Google Groups: https://groups.google.com/forum/#!topic/gonids/

• suricata
• parse
• security-tools
• network-security

Suricata rules for network anomaly detection

• suricata-rule
• suricata
• ids
• nsm

Hascat Rules Collection – Probably the largest collection of hashcat rule-files anywhere.

• hashcat
• hashcat-rules
• hashcat-rule
• password-cracking

The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX account.

Machine-learn password mangling rules

Custom password cracking rules for Hashcat and John the Ripper

• password-cracking
• hashcat
• johntheripper
• jtr

OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans

• crowdsec
• intrusion-detection
• intrusion-detection-system
• intrusion-prevention

Collection of hashcat lists and things.

• hashcat
• hashcat-rules
• hashcat-masks
• password-cracking

Advanced Phishing Protection: Suricata rulesets open and free

• anti-phishing
• antiphishing
• openphish
• phishing

Rule Processor Y is a next-gen Rule processor with complex multibyte character support built to support Hashcat

• cybersecurity
• hashcat
• hashcat-rules
• johntheripper

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir

Yet another implementation of PEiD with yara

• binary-analysis
• yara
• yara-rules
• peid

Threat Detection Rules (Snort/Sigma/Yara)

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

• ansible
• ansible-playbook
• devsecops
• infrastructure-as-code

The repository host gives no description.

Open-source PocketBase security auditor: detects empty rules, the @request.auth.id != trap, true literals. Active probe confirms leaks live.

• audit
• auditor
• cli
• devsecops

Simple tool to find the yara matches on a file

• yara
• yara-rules
• malware
• malware-analysis