Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
Repository Index
47,133 repositories indexed
1–24 of 41 · Most stars
Repository of yara rules
Loki - Simple IOC and YARA Scanner
- python
- yara
- signature
- scanner
The repository host gives no description.
- threat-detection
- threat-hunting
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
Awesome Django authorization, without the database
- python
- django
- permissions
- rules
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
- cve-2026-109618
- cve-2026-109619
- detection-rules
- exploit
yarGen is a generator for YARA rules
- python
- yara
- malware
- malware-research
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Linting tool for CloudFormation templates
- continuous-testing
- unit-testing
- cloudformation
- aws
Wordlist, rules and masks from Kaonashi project (RootedCON 2019)
- wordlist
- password
- password-strength
- password-safety
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code
- php
- php-codesniffer
- phpcs
- static-code-analysis
Scirius is a web application for Suricata ruleset management and threat hunting.
- python
- security
- management
- interface
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Collection of example YARA-L rules for use within Google Security Operations
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
Rule for hashcat or john. Aiming to crack how people generate their password
- hashcat
- hashcat-rules
- john
- john-rules
Built-in Panther detection rules and policies
- security
- python
- cybersecurity
- siem
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.
- agent-security
- ai-security
- llm-security
- mcp-security
large hashcat rulesets generated from real-world compromised passwords
- hashcat
- hashcat-rules
- password-cracking
- security-research
Splunk code (SPL) for serious threat hunters and detection engineers.
- splunk
- threat-hunting
- use-case
- siem