detection-engineering

There are 22 repositories under detection-engineering topic.

sbousseaden / EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
dataset detection-engineering dfir evtx mitre-attack threat-hunting windows-security winlogbeat
Language:HTML 2252
DataDog / stratus-red-team
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
aws adversary-emulation purple-team mitre-attack cloud-security cloud-native-security detection-engineering threat-detection security aws-security azure-security kubernetes-security gcp-security
Language:Go 1830
Digital-Forensics-Guide
mikeroyal / Digital-Forensics-Guide
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
alerting cyber-security detection-engineering dfir digital-forensics digitalforensicreadiness digitalforensics forensic-analysis forensics forensics-investigations forensics-tools intrusion-detection mitre-attack network-security offensive-security osint port-scanning security siem threat-intelligence
Language:Python 1658
matano
matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
alerting apache-iceberg aws aws-security big-data cloud cloud-native cloud-security cybersecurity detection-engineering dfir log-analytics log-management rust secops security security-tools serverless siem threat-hunting
Language:Rust 1474
security_content
splunk / security_content
Splunk Security Content
splunk detection engineering responses cicd cybersecurity detection-engineering
Language:Python 1295
Open-Source-Security-Guide
mikeroyal / Open-Source-Security-Guide
Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.
compliance cyber-security detection-engineering forensics-tools incident-management incident-response information-security infosec intrusion-detection kali-linux mitre-attack network-analysis offensive-security pentesters privacy-protection scanning-tool siem surveillance vulnerabilities vulnerability-detection
Language:Go 919
infosecB / awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
detection-engineering splunk mitre awesome-list awesome cybersecurity threat-detection
850
mvelazc0 / PurpleSharp
PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments
adversary-simulation controls-validation detection-engineering purple-team
Language:C# 775
BushidoUK / Ransomware-Tool-Matrix
A resource containing all the tools each ransomware gangs uses
cti cybersecurity detection-engineering hacking osint ransomware threat-hunting threat-intelligence threatintel
759
awesome-lists
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
blueteam hacktools redteam security soc awesome-list cti ioc blueteam-tools detection detection-engineering dfir incident-response iocs ir siem threat-hunting threat-intelligence ransomware rmm
Language:GLSL 715
runreveal / pql
Pipelined Query Language
clickhouse detection-engineering go golang query-language siem sql
Language:Go 646
Threat-Hunting-and-Detection
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
threat-hunting threat-detection cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel
Language:Jupyter Notebook 642
ThreatHunting-Keywords
mthcht / ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
awesome-list blueteam detection-engineering dfir elk-stack endpoint-security forensic hacktools incident-response iocs offensive-scripts offensive-security redteam siem soc splunk threat-hunting threat-intelligence threathunting yara-rules
Language:HTML 473
Aegrah / PANIX
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
backdoor bash detection-engineering linux panix persistence security-research shell unix
Language:Shell 415
sbousseaden / Slides
Misc Threat Hunting Resources
detection-engineering dfir mindmap threat-hunting
372
nianticlabs / venator
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
detection-engineering golang kubernetes threat-detection
Language:Go 351
DataDog / threatest
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
continuous-security detection-engineering security-automation threat-detection
Language:Go 319
DataDog / grimoire
Generate datasets of cloud audit logs for common attacks
cloud-security detection-engineering purpleteaming
Language:Go 185
nasbench / SIGMA-Resources
Resources To Learn And Understand SIGMA Rules
sigma rules detection detection-engineering sigma-rules resources learning windows linux awesome
168
0xrawsec / gene
Signature engine for all your logs
detection-engineering dfir threat-hunting
Language:Go 161
Purpleteam
mthcht / Purpleteam
Purpleteam scripts simulation & Detection - trigger events for SOC detections
blueteam detection linux mitre-attack offensive-scripts purpleteam redteam security siem simulation soc tactics techniques windows awesome awesome-list ioc threat-hunting threathunting detection-engineering
Language:PowerShell 158
SIEGMA
3CORESec / SIEGMA
SIEGMA - Transform Sigma rules into SIEM consumables
sigma detection-engineering siem security data-driven
Language:Python 141
ControlCompass / ControlCompass.github.io
Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques
security intelligence cybersecurity threat-intelligence threat-hunting red-teaming red-team detection detection-engineering mitre-attack siem security-tools security-operations soc infosec information-security
Language:JavaScript 123
lawndoc / AdvancedHuntingQueries
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant
security cybersecurity kusto kql hunting threat-hunting detection detection-engineering microsoft microsoft365 defender-for-endpoint defender defender-atp cyber-security xdr
111
mvelazc0 / attack2jira
attack2jira automates the process of standing up a Jira environment that can be used to track and measure ATT&CK coverage
mitre-attack detection-engineering mitre attack-coverage
Language:Python 111
ThreatHunting-Keywords-yara-rules
mthcht / ThreatHunting-Keywords-yara-rules
yara detection rules for hunting with the threathunting-keywords project
awesome-list blueteam detection-engineering dfir forensics-tools hacktools hunting incident-response offensive-security threat-hunting threat-intelligence yara-forensics yara-rules yara-scanner yara-signatures
Language:YARA 87
anvilogic-forge / armory
Anvilogic Forge
detection detection-engineering snowflake splunk threat-hunting
86
sigma-go
bradleyjkemp / sigma-go
A Go implementation and parser for Sigma rules.
sigma detection-engineering
Language:Go 84
0xAnalyst / DefenderATPQueries
Hunting Queries for Defender ATP
defender-atp detection-engineering detection-rules kql microsoft sentinel threat-hunting
73
DFIR-Detection-Engineering
adrianlois / DFIR-Detection-Engineering
Digital Forensics Incident Response and Detection engineering: Análisis forense de artefactos comunes y no tan comunes. Técnicas anti-forense y detección de técnicas utilizadas por actores maliciosos para la evasión de sistemas de protección y monitorización.
cybersecurity deteccion dfir forense malware security tips tricks anti-forense detection-engineering artefactos artefacts evidencias forensics linux macosx windows digital-forensics incident-response
73
AttackIQ / SigmAIQ
A pySigma wrapper and langchain toolkit for automatic rule creation/translation
detection-engineering langchain llm python3 security security-tools sigma sigma-rules
Language:Python 66
reversinglabs / reversinglabs-siem-rules
A collection of various SIEM rules relating to malware family groups.
detection-engineering infosec microsoft-sentinel siem
Language:YARA 62
west-wind / Threat-Hunting-With-Splunk
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
detection splunk mitre-attack bpfdoor vulnerability bpfdoor-detection text4shell detection-engineering esxi-malware esxi-ransomware rtm-locker arcanedoor line-runner cve-2024-20353 cve-2024-20359 line-dancer
57
3CORESec / Automata
Automatic detection engineering technical state compliance
sigma caldera detection detection-engineering
Language:Python 50
infosecB / detection-as-code
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
blueteam cybersecurity detection-engineering threat-detection
Language:Python 49
ThreatHunting-Keywords-sigma-rules
mthcht / ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
blueteam detection-engineering detection-rules dfir forensicartifacts mitre-attack siem sigma-rules threat-detection threat-hunting threathunting
Language:Python 47

detection-engineering

sbousseaden / EVTX-ATTACK-SAMPLES

DataDog / stratus-red-team

mikeroyal / Digital-Forensics-Guide

matanolabs / matano

splunk / security_content

mikeroyal / Open-Source-Security-Guide

infosecB / awesome-detection-engineering

mvelazc0 / PurpleSharp

BushidoUK / Ransomware-Tool-Matrix

mthcht / awesome-lists

runreveal / pql

Cyb3r-Monk / Threat-Hunting-and-Detection

mthcht / ThreatHunting-Keywords

Aegrah / PANIX

sbousseaden / Slides

nianticlabs / venator

DataDog / threatest

DataDog / grimoire

nasbench / SIGMA-Resources

0xrawsec / gene

mthcht / Purpleteam

3CORESec / SIEGMA

ControlCompass / ControlCompass.github.io

lawndoc / AdvancedHuntingQueries

mvelazc0 / attack2jira

mthcht / ThreatHunting-Keywords-yara-rules

anvilogic-forge / armory

bradleyjkemp / sigma-go

0xAnalyst / DefenderATPQueries

adrianlois / DFIR-Detection-Engineering

AttackIQ / SigmAIQ

reversinglabs / reversinglabs-siem-rules

west-wind / Threat-Hunting-With-Splunk

3CORESec / Automata

infosecB / detection-as-code

mthcht / ThreatHunting-Keywords-sigma-rules