1.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
+6 stars
from 4,700 · score 1.95
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
8 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.google / timesketch
Collaborative forensic timeline analysis
+6 stars
from 3,442 · score 1.95
3.JPCERTCC / LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
+5 stars
from 3,294 · score 1.79
4.RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
+3 stars
from 1,549 · score 1.39
5.fox-it / dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
+3 stars
from 1,176 · score 1.39
6.ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
+2 stars
from 1,096 · score 1.10
7.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
+1 stars
from 1,763 · score 0.69
8.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+1 stars
from 870 · score 0.69