Repository Index

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

Sysmon configuration file template with default high-quality event tracing

• sysmon
• threatintel
• threat-hunting
• sysinternals

Chrome extension and Express server that exploits keylogging abilities of CSS.

🔐 An SSL library for configuring http client or server. Rich with features such as hot reloading ssl and trusting additional certificates during runtime, combining multiple keystores, loading pem files and os/jdk certificates, logging certificate information during ssl handshake, bypassing ssl configuration from other libraries and more

• tls
• ssl
• certificate
• keystore

Simulates enough of a Telnet connection in order to log failed login attempts.

Toggle the iPhone call-recording announcement on/off from a Windows GUI, built on the airlift AirTraffic sandbox escape.

• airlift
• airtraffic
• ios
• sandbox-escape

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

• anti-surveillance
• dfir
• keylogger-detector
• privacy

Zero-code K8s sidecar for log sanitization. Detects secrets via Entropy Analysis, preserves JSON integrity, and redacts PII deterministically. 🛡️

• devsecops
• entropy
• gdpr
• golang

NTP logger/honeypot

A low/zero interaction ssh authentication logging honeypot

• ssh-server
• honeynet

A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.

• cpp20
• ebpf
• event-logger
• filesystem