1.SigmaHQ / sigma
Main Sigma Rule Repository
+237 stars
from 11,148 · score 5.47
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
6 repositories by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
2.SwiftOnSecurity / sysmon-config
Sysmon configuration file template with default high-quality event tracing
+47 stars
from 5,671 · score 3.87
3.olafhartong / sysmon-modular
A repository of sysmon configuration modules
+38 stars
from 3,145 · score 3.66
4.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
+28 stars
from 498 · score 3.37
5.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
+25 stars
from 4,681 · score 3.26
6.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+16 stars
from 855 · score 2.83