Main Sigma Rule Repository
Repository Index
47,133 repositories indexed
1–24 of 48 · Most stars
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
Repository of yara rules
Loki - Simple IOC and YARA Scanner
- python
- yara
- signature
- scanner
The repository host gives no description.
- threat-detection
- threat-hunting
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
A tool to abuse Exchange services
- mapi
- exchange
- shells
- pentesting
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
Awesome Django authorization, without the database
- python
- django
- permissions
- rules
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
- cve-2026-109618
- cve-2026-109619
- detection-rules
- exploit
yarGen is a generator for YARA rules
- python
- yara
- malware
- malware-research
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
One rule to crack all passwords. or atleast we hope so.
Wordlist, rules and masks from Kaonashi project (RootedCON 2019)
- wordlist
- password
- password-strength
- password-safety
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code
- php
- php-codesniffer
- phpcs
- static-code-analysis
Scirius is a web application for Suricata ruleset management and threat hunting.
- python
- security
- management
- interface
A revamped and updated version of my original OneRuleToRuleThemAll hashcat rule
Password cracking rules and masks for hashcat that I generated from cracked passwords.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Collection of example YARA-L rules for use within Google Security Operations
Rule for hashcat or john. Aiming to crack how people generate their password
- hashcat
- hashcat-rules
- john
- john-rules
Built-in Panther detection rules and policies
- security
- python
- cybersecurity
- siem
large hashcat rulesets generated from real-world compromised passwords
- hashcat
- hashcat-rules
- password-cracking
- security-research