detection-engineering

There are 18 repositories under detection-engineering topic.

sbousseaden / EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
threat-hunting evtx windows-security mitre-attack detection-engineering dataset winlogbeat dfir
Language:HTML 2131
DataDog / stratus-red-team
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
adversary-emulation aws aws-security azure-security cloud-native-security cloud-security detection-engineering gcp-security kubernetes-security mitre-attack purple-team security threat-detection
Language:Go 1622
Digital-Forensics-Guide
mikeroyal / Digital-Forensics-Guide
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
digitalforensics digitalforensicreadiness forensics security forensics-tools digital-forensics threat-intelligence intrusion-detection mitre-attack detection-engineering network-security offensive-security cyber-security port-scanning siem alerting forensic-analysis forensics-investigations osint dfir
Language:Python 1359
matano
matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
aws cloud security big-data serverless apache-iceberg log-analytics log-management threat-hunting rust alerting cloud-native aws-security cloud-security cybersecurity secops security-tools dfir detection-engineering siem
Language:Rust 1358
security_content
splunk / security_content
Splunk Security Content
cicd cybersecurity detection detection-engineering engineering responses splunk
Language:Python 1141
Open-Source-Security-Guide
mikeroyal / Open-Source-Security-Guide
Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.
vulnerabilities vulnerability-detection privacy-protection pentesters network-analysis intrusion-detection infosec incident-management mitre-attack detection-engineering kali-linux offensive-security information-security siem compliance cyber-security scanning-tool incident-response forensics-tools surveillance
Language:Go 855
mvelazc0 / PurpleSharp
PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments
adversary-simulation controls-validation detection-engineering purple-team
Language:C# 747
runreveal / pql
Pipelined Query Language
clickhouse detection-engineering go golang query-language siem sql
Language:Go 616
Threat-Hunting-and-Detection
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel threat-detection threat-hunting
Language:Jupyter Notebook 563
infosecB / awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
awesome awesome-list cybersecurity detection-engineering mitre splunk threat-detection
554
sbousseaden / Slides
Misc Threat Hunting Resources
threat-hunting detection-engineering mindmap dfir
361
ThreatHunting-Keywords
mthcht / ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
awesome-list blueteam detection-engineering endpoint-security iocs offensive-scripts offensive-security redteam siem soc splunk threat-hunting threat-intelligence threathunting dfir incident-response forensic hacktools sigma-rules elk-stack
Language:HTML 340
DataDog / threatest
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
continuous-security detection-engineering security-automation threat-detection
Language:Go 305
nasbench / SIGMA-Resources
Resources To Learn And Understand SIGMA Rules
sigma rules detection detection-engineering sigma-rules resources learning windows linux awesome
160
0xrawsec / gene
Signature engine for all your logs
dfir threat-hunting detection-engineering
Language:Go 151
SIEGMA
3CORESec / SIEGMA
SIEGMA - Transform Sigma rules into SIEM consumables
data-driven detection-engineering security siem sigma
Language:Python 137
Purpleteam
mthcht / Purpleteam
Purpleteam scripts simulation & Detection - trigger events for SOC detections
blueteam detection linux mitre-attack offensive-scripts purpleteam redteam security siem simulation soc tactics techniques windows awesome awesome-list ioc threat-hunting threathunting detection-engineering
Language:PowerShell 123
ControlCompass / ControlCompass.github.io
Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques
security intelligence cybersecurity threat-intelligence threat-hunting red-teaming red-team detection detection-engineering mitre-attack siem security-tools security-operations soc infosec information-security
Language:JavaScript 117
mvelazc0 / attack2jira
attack2jira automates the process of standing up a Jira environment that can be used to track and measure ATT&CK coverage
attack-coverage detection-engineering mitre mitre-attack
Language:Python 112
lawndoc / AdvancedHuntingQueries
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant
cyber-security cybersecurity defender defender-atp defender-for-endpoint detection detection-engineering hunting kql kusto microsoft microsoft365 security threat-hunting xdr
94
sigma-go
bradleyjkemp / sigma-go
A Go implementation and parser for Sigma rules.
detection-engineering sigma
Language:Go 76
anvilogic-forge / armory
Anvilogic Forge
detection detection-engineering threat-hunting snowflake splunk
62
DFIR-Detection-Engineering
adrianlois / DFIR-Detection-Engineering
Digital Forensics Incident Response and Detection engineering: Análisis forense de artefactos comunes y no tan comunes. Técnicas anti-forense y detección de técnicas utilizadas por actores maliciosos para la evasión de sistemas de protección y monitorización.
anti-forense artefactos artefacts cybersecurity deteccion detection-engineering dfir digital-forensics evidencias forense forensics incident-response linux macosx malware security tips tricks windows
61
reversinglabs / reversinglabs-siem-rules
A collection of various SIEM rules relating to malware family groups.
detection-engineering infosec microsoft-sentinel siem
Language:YARA 58
west-wind / Threat-Hunting-With-Splunk
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
detection splunk mitre-attack bpfdoor vulnerability bpfdoor-detection text4shell detection-engineering esxi-malware esxi-ransomware rtm-locker arcanedoor line-runner cve-2024-20353 cve-2024-20359 line-dancer
49
3CORESec / Automata
Automatic detection engineering technical state compliance
caldera detection detection-engineering sigma
Language:Python 48
ThreatHunting-Keywords-yara-rules
mthcht / ThreatHunting-Keywords-yara-rules
yara detection rules for hunting with the threathunting-keywords project
awesome-list blueteam detection-engineering dfir forensics-tools hacktools hunting incident-response offensive-security threat-hunting threat-intelligence yara-forensics yara-rules yara-scanner yara-signatures
Language:YARA 48
M3NIX / sigmaio
simple webapp for converting sigma rules into siem queries using the pySigma library
detection-engineering sigma splunk pysigma
Language:HTML 47
infosecB / detection-as-code
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
threat-detection cybersecurity detection-engineering blueteam
Language:Python 43
ThreatHunting-Keywords-sigma-rules
mthcht / ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
blueteam detection-engineering detection-rules siem sigma-rules threat-detection threat-hunting threathunting dfir forensicartifacts mitre-attack
Language:Python 40
center-for-threat-informed-defense / summiting-the-pyramid
Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research includes a scoring model, methodology, and worked examples.
ctid cyber-analytics cybersecurity detection-engineering mitre-attack threat-informed-defense
Language:Makefile 22
threat-punter / detection-as-code-example
A POC to implement Detection-as-Code with Terraform and Sumo Logic.
blue-team cybersecurity detection-as-code detection-engineering infosec
Language:Python 20
JakePeralta7 / CyberSecurity
Research, Rules, Books, Tools and more basic stuff you can get anywhere
cybersecurity detection-engineering dfir resources threat-hunting
Language:Python 10
erickatwork / threat-detection-engineering-reference
Resource for all things threat detection
detection detection-engineering incident-response mitre-attack reference risk-based security threat-intelligence threat-modeling detection-as-code distributed-alerting risk-based-alerting
7
BenjiTrapp / aws-threat-hunting
Short deep dive into Threat Hunting on AWS
aws cloudtrail detection-engineering jupyter-notebook threathunting
Language:Jupyter Notebook 6
qasimqlf / StepbyStep_CyberSecurity
A Step by Step Guide for Cyber Security Beginners to Jump into the right path
cyber-security cybersecurity cybersecurity-awareness cybersecurity-incidents detection-engineering guidelines hacktoberfest hacktoberfest2022 threat-hunting tutorials
6

detection-engineering

sbousseaden / EVTX-ATTACK-SAMPLES

DataDog / stratus-red-team

mikeroyal / Digital-Forensics-Guide

matanolabs / matano

splunk / security_content

mikeroyal / Open-Source-Security-Guide

mvelazc0 / PurpleSharp

runreveal / pql

Cyb3r-Monk / Threat-Hunting-and-Detection

infosecB / awesome-detection-engineering

sbousseaden / Slides

mthcht / ThreatHunting-Keywords

DataDog / threatest

nasbench / SIGMA-Resources

0xrawsec / gene

3CORESec / SIEGMA

mthcht / Purpleteam

ControlCompass / ControlCompass.github.io

mvelazc0 / attack2jira

lawndoc / AdvancedHuntingQueries

bradleyjkemp / sigma-go

anvilogic-forge / armory

adrianlois / DFIR-Detection-Engineering

reversinglabs / reversinglabs-siem-rules

west-wind / Threat-Hunting-With-Splunk

3CORESec / Automata

mthcht / ThreatHunting-Keywords-yara-rules

M3NIX / sigmaio

infosecB / detection-as-code

mthcht / ThreatHunting-Keywords-sigma-rules

center-for-threat-informed-defense / summiting-the-pyramid

threat-punter / detection-as-code-example

JakePeralta7 / CyberSecurity

erickatwork / threat-detection-engineering-reference

BenjiTrapp / aws-threat-hunting

qasimqlf / StepbyStep_CyberSecurity