detection-engineering

There are 21 repositories under detection-engineering topic.

sbousseaden / EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
dataset detection-engineering dfir evtx mitre-attack threat-hunting windows-security winlogbeat
Language:HTML 2201
DataDog / stratus-red-team
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
adversary-emulation aws aws-security azure-security cloud-native-security cloud-security detection-engineering gcp-security kubernetes-security mitre-attack purple-team security threat-detection
Language:Go 1752
Digital-Forensics-Guide
mikeroyal / Digital-Forensics-Guide
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
digitalforensics digitalforensicreadiness forensics security forensics-tools digital-forensics threat-intelligence intrusion-detection mitre-attack detection-engineering network-security offensive-security cyber-security port-scanning siem alerting forensic-analysis forensics-investigations osint dfir
Language:Python 1598
matano
matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
aws cloud security big-data serverless apache-iceberg log-analytics log-management threat-hunting rust alerting cloud-native aws-security cloud-security cybersecurity secops security-tools dfir detection-engineering siem
Language:Rust 1447
security_content
splunk / security_content
Splunk Security Content
splunk detection engineering responses cicd cybersecurity detection-engineering
Language:Python 1253
Open-Source-Security-Guide
mikeroyal / Open-Source-Security-Guide
Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.
compliance cyber-security detection-engineering forensics-tools incident-management incident-response information-security infosec intrusion-detection kali-linux mitre-attack network-analysis offensive-security pentesters privacy-protection scanning-tool siem surveillance vulnerabilities vulnerability-detection
Language:Go 896
infosecB / awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
awesome awesome-list cybersecurity detection-engineering mitre splunk threat-detection
803
mvelazc0 / PurpleSharp
PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments
adversary-simulation controls-validation detection-engineering purple-team
Language:C# 767
runreveal / pql
Pipelined Query Language
clickhouse detection-engineering go golang query-language siem sql
Language:Go 638
awesome-lists
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
awesome-list blueteam blueteam-tools cti detection detection-engineering dfir hacktools incident-response ioc iocs ir ransomware redteam rmm security siem soc threat-hunting threat-intelligence
Language:GLSL 630
Threat-Hunting-and-Detection
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel threat-detection threat-hunting
Language:Jupyter Notebook 595
BushidoUK / Ransomware-Tool-Matrix
A resource containing all the tools each ransomware gangs uses
cti cybersecurity detection-engineering hacking osint ransomware threat-hunting threat-intelligence threatintel
557
ThreatHunting-Keywords
mthcht / ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
awesome-list blueteam detection-engineering endpoint-security iocs offensive-scripts offensive-security redteam siem soc splunk threat-hunting threat-intelligence threathunting dfir incident-response forensic hacktools elk-stack yara-rules
Language:HTML 441
Aegrah / PANIX
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
bash detection-engineering linux persistence security-research shell panix unix backdoor
Language:Shell 379
sbousseaden / Slides
Misc Threat Hunting Resources
threat-hunting detection-engineering mindmap dfir
368
DataDog / threatest
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
continuous-security detection-engineering security-automation threat-detection
Language:Go 313
nasbench / SIGMA-Resources
Resources To Learn And Understand SIGMA Rules
awesome detection detection-engineering learning linux resources rules sigma sigma-rules windows
163
DataDog / grimoire
Generate datasets of cloud audit logs for common attacks
cloud-security detection-engineering purpleteaming
Language:Go 158
0xrawsec / gene
Signature engine for all your logs
dfir threat-hunting detection-engineering
Language:Go 156
Purpleteam
mthcht / Purpleteam
Purpleteam scripts simulation & Detection - trigger events for SOC detections
blueteam detection linux mitre-attack offensive-scripts purpleteam redteam security siem simulation soc tactics techniques windows awesome awesome-list ioc threat-hunting threathunting detection-engineering
Language:PowerShell 149
SIEGMA
3CORESec / SIEGMA
SIEGMA - Transform Sigma rules into SIEM consumables
sigma detection-engineering siem security data-driven
Language:Python 139
ControlCompass / ControlCompass.github.io
Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques
cybersecurity detection detection-engineering information-security infosec intelligence mitre-attack red-team red-teaming security security-operations security-tools siem soc threat-hunting threat-intelligence
Language:JavaScript 120
mvelazc0 / attack2jira
attack2jira automates the process of standing up a Jira environment that can be used to track and measure ATT&CK coverage
mitre-attack detection-engineering mitre attack-coverage
Language:Python 110
lawndoc / AdvancedHuntingQueries
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant
security cybersecurity kusto kql hunting threat-hunting detection detection-engineering microsoft microsoft365 defender-for-endpoint defender defender-atp cyber-security xdr
107
sigma-go
bradleyjkemp / sigma-go
A Go implementation and parser for Sigma rules.
sigma detection-engineering
Language:Go 82
anvilogic-forge / armory
Anvilogic Forge
detection detection-engineering threat-hunting snowflake splunk
80
ThreatHunting-Keywords-yara-rules
mthcht / ThreatHunting-Keywords-yara-rules
yara detection rules for hunting with the threathunting-keywords project
awesome-list blueteam detection-engineering dfir forensics-tools hacktools hunting incident-response offensive-security threat-hunting threat-intelligence yara-forensics yara-rules yara-scanner yara-signatures
Language:YARA 75
0xAnalyst / DefenderATPQueries
Hunting Queries for Defender ATP
defender-atp detection-engineering detection-rules kql microsoft sentinel threat-hunting
70
DFIR-Detection-Engineering
adrianlois / DFIR-Detection-Engineering
Digital Forensics Incident Response and Detection engineering: Análisis forense de artefactos comunes y no tan comunes. Técnicas anti-forense y detección de técnicas utilizadas por actores maliciosos para la evasión de sistemas de protección y monitorización.
cybersecurity deteccion dfir forense malware security tips tricks anti-forense detection-engineering artefactos artefacts evidencias forensics linux macosx windows digital-forensics incident-response
68
AttackIQ / SigmAIQ
A pySigma wrapper and langchain toolkit for automatic rule creation/translation
detection-engineering langchain llm python3 security security-tools sigma sigma-rules
Language:Python 64
reversinglabs / reversinglabs-siem-rules
A collection of various SIEM rules relating to malware family groups.
detection-engineering infosec microsoft-sentinel siem
Language:YARA 60
west-wind / Threat-Hunting-With-Splunk
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
arcanedoor bpfdoor bpfdoor-detection cve-2024-20353 cve-2024-20359 detection detection-engineering esxi-malware esxi-ransomware line-dancer line-runner mitre-attack rtm-locker splunk text4shell vulnerability
55
3CORESec / Automata
Automatic detection engineering technical state compliance
caldera detection detection-engineering sigma
Language:Python 49
infosecB / detection-as-code
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
blueteam cybersecurity detection-engineering threat-detection
Language:Python 49
M3NIX / sigmaio
simple webapp for converting sigma rules into siem queries using the pySigma library
detection-engineering sigma splunk pysigma
Language:HTML 47
ThreatHunting-Keywords-sigma-rules
mthcht / ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
blueteam detection-engineering detection-rules siem sigma-rules threat-detection threat-hunting threathunting dfir forensicartifacts mitre-attack
Language:Python 47

detection-engineering

sbousseaden / EVTX-ATTACK-SAMPLES

DataDog / stratus-red-team

mikeroyal / Digital-Forensics-Guide

matanolabs / matano

splunk / security_content

mikeroyal / Open-Source-Security-Guide

infosecB / awesome-detection-engineering

mvelazc0 / PurpleSharp

runreveal / pql

mthcht / awesome-lists

Cyb3r-Monk / Threat-Hunting-and-Detection

BushidoUK / Ransomware-Tool-Matrix

mthcht / ThreatHunting-Keywords

Aegrah / PANIX

sbousseaden / Slides

DataDog / threatest

nasbench / SIGMA-Resources

DataDog / grimoire

0xrawsec / gene

mthcht / Purpleteam

3CORESec / SIEGMA

ControlCompass / ControlCompass.github.io

mvelazc0 / attack2jira

lawndoc / AdvancedHuntingQueries

bradleyjkemp / sigma-go

anvilogic-forge / armory

mthcht / ThreatHunting-Keywords-yara-rules

0xAnalyst / DefenderATPQueries

adrianlois / DFIR-Detection-Engineering

AttackIQ / SigmAIQ

reversinglabs / reversinglabs-siem-rules

west-wind / Threat-Hunting-With-Splunk

3CORESec / Automata

infosecB / detection-as-code

M3NIX / sigmaio

mthcht / ThreatHunting-Keywords-sigma-rules