1.SigmaHQ / sigma
Main Sigma Rule Repository
+573 stars
from 10,812 · score 6.35
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
7 repositories by Attention Score · Aug 5, 2026 – Nov 2, 2026 (UTC)
2.SwiftOnSecurity / sysmon-config
Sysmon configuration file template with default high-quality event tracing
+123 stars
from 5,595 · score 4.82
3.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
+87 stars
from 4,619 · score 4.48
4.olafhartong / sysmon-modular
A repository of sysmon configuration modules
+86 stars
from 3,097 · score 4.47
5.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
+84 stars
from 442 · score 4.44
6.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+33 stars
from 838 · score 3.53
7.JPCERTCC / SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
+1 stars
from 431 · score 0.69