There are 3 repositories under sigma-rules topic.
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Elemental - An ATT&CK Threat Library
IOK (Indicator Of Kit) is an open source language and ruleset for detecting phishing threat actor tools and tactics
Mapping of open-source detection rules and atomic tests.
Resources To Learn And Understand SIGMA Rules
BlackBerry Threat Research & Intelligence
Sigma detection rules for hunting with the threathunting-keywords project
Framework definitions that allow to build a custom SIEM.
SysFlow edge processing pipeline
Convert Sigma Rules to different formats
[ARCHIVED -- USE TXT2DETECTION] A command line tool that converts Sigma Rules into STIX 2.1 Objects.
Repository of Sigma Rules
Scripts played by GitHub Actions that converts Sigma rules to SentinelOne PowerQuery via PySigma.
Script that organize Sigma rules by MITRE | ATT&CK tactics and techniques.
Hayabusa to the SIEM made easy
Threat Detection Repository - YARA / SIGMA rules
Simple browser playground for Sigma rule format.
Threat Hunting Rules - work in progress
Sigma rules fun API. A restful API which contains most funny sigma rules. Sigma-rule-api made by subhranhsu sekhar choudhury.
**Palantir Threat Detection: Open SIEM Labs with Sigma Rules** This repository is intended for educational and research purposes only. It is not a 100% protection against Palantir-related activity or any other advanced threats. Security is about reducing risk, not eliminating it.
Pick and convert to specific backends for sigma rules within neovim
🌋 ETNA - Enhanced Threat Network Analysis | Sicilian-inspired automated threat hunting platform with MITRE ATT&CK integration
Manage your detection use cases portfolio
The Active Directory Event Detection Guide is a comprehensive resource developed to enhance the detection and monitoring of critical Active Directory (AD) events using Splunk. This guide is intended for cybersecurity professionals, system administrators, and incident responders aiming to boost visibility into AD activities and strengthen their orga
Ransomware Detection and Analysis Framework
This repository contains a collection of threat hunting rules.
This repository contains Sigma detection rules tailored to protect the healthcare sector from cyber threats such as ransomware, phishing, and insider attacks.
A Python command-line tool for quickly searching Sigma rules.