sigma-rules

There are 3 repositories under sigma-rules topic.

ion-storm / sysmon-config
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
sysmon threatintel threat-hunting netsec sysinternals logging graylog graylog-plugin dfir threat-intelligence threat-sharing threat-analysis mitre-attack digitalforensics forensic-analysis forensicartifacts forensics siem sigma-rules humio
Language:PowerShell 812
wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
auditd detection evtx evtxtract forensics forensics-tools pysigma python3 sigma sigma-rules sysmon
Language:Python 750
Elemental-attack / Elemental
Elemental - An ATT&CK Threat Library
sigma-rules mitre-attack atomicredteam attack-defense attack-detection threat-intelligence
Language:HTML 320
IOK
phish-report / IOK
IOK (Indicator Of Kit) is an open source language and ruleset for detecting phishing threat actor tools and tactics
phishing phishing-detection phishing-kit sigma-rules
Language:Go 189
krdmnbrk / AttackRuleMap
Mapping of open-source detection rules and atomic tests.
atomicredteam detection-engineering sigma-rules splunk
183
nasbench / SIGMA-Resources
Resources To Learn And Understand SIGMA Rules
sigma rules detection detection-engineering sigma-rules resources learning windows linux awesome
181
blackberry / threat-research-and-intelligence
BlackBerry Threat Research & Intelligence
artificial-intelligence iocs machine-learning research sigma-rules suricata-rules threatintelligence yara-rules
Language:Jupyter Notebook 99
3CORESec / S2AN
S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator
mitre-attack sigma sigma-rules suricata suricata-rules threat-hunting threat-modeling
Language:C# 89
AttackIQ / SigmAIQ
A pySigma wrapper and langchain toolkit for automatic rule creation/translation
detection-engineering langchain llm python3 security security-tools sigma sigma-rules
Language:Python 86
ThreatHunting-Keywords-sigma-rules
mthcht / ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
blueteam detection-engineering detection-rules siem sigma-rules threat-detection threat-hunting threathunting dfir forensicartifacts mitre-attack
Language:Python 56
u-siem / u-siem-core
Framework definitions that allow to build a custom SIEM.
siem security rust sigma-rules
Language:Rust 28
sysflow-telemetry / sf-processor
SysFlow edge processing pipeline
analytics falco falco-rules plugins real-time rules rules-engine sigma sigma-rules open-telemetry otel otel-agent
Language:Go 17
marirs / sigma-convert
Convert Sigma Rules to different formats
rust-crate rust-lang sigma sigma-rules sigma-convert
Language:Rust 12
sigma2stix
muchdogesec / sigma2stix
[ARCHIVED -- USE TXT2DETECTION] A command line tool that converts Sigma Rules into STIX 2.1 Objects.
sigma-rules stix2
Language:Python 12
RussianPanda95 / Sigma-Rules
Repository of Sigma Rules
malware-detection malware-research sigma-rules technique-detection
9
wikijm / ConvertSigmaRepo2SentinelOnePQ
Scripts played by GitHub Actions that converts Sigma rules to SentinelOne PowerQuery via PySigma.
github-actions sentinelone sentinelone-singularity sigma sigma-rules
Language:Python 9
dan21san / sigma-tactics-organizer
Script that organize Sigma rules by MITRE | ATT&CK tactics and techniques.
mitre-attack organizer sigma-rules
Language:Python 6
xFFninja / happy_threat_hunting
Threat Hunting
detection kql siem sigma-rules threathunting
6
mf1d3l / HayabusaToWinEventLog
Hayabusa to the SIEM made easy
hayabusa incident-response siem threat-hunting detection-engineering sigma-rules blue-team
Language:PowerShell 4
whichbuffer / Threat-Detection-Rules
Threat Detection Repository - YARA / SIGMA rules
cti detection detection-engineering malware malware-analysis sigma-rules yara-rules
Language:YARA 4
bradleyjkemp / sigmadoc
A static site generator for @SigmaHQ rules
sigma sigma-rules
Language:JavaScript 3
j91321 / sigma-playground
Simple browser playground for Sigma rule format.
sigma sigma-rules monaco-editor pyodide siem security logging sysmon elasticsearch splunk
Language:Vue 3
sansan-monkey / hunting-rules
Threat Hunting Rules - work in progress
malware-analysis sigma-rules threat-detection threat-hunting yara-rules
3
subhranshuchoudhury / sigma-rules-api
Sigma rules fun API. A restful API which contains most funny sigma rules. Sigma-rule-api made by subhranhsu sekhar choudhury.
api-rest node-application restful-api sigma-rule sigma-rules webapplication sigma-rules-api subhranshu-sekhar-choudhury men-sigma-rules-api
Language:EJS 3
sigma-rules
vVv-Keys / sigma-rules
WARNING - DO NOT USE IF YOU DON'T KNOW WHAT YOU'RE DOING!
sigma-rules
Language:PowerShell 3
arblade / nyx
a new network detection format (sigma like but for network)
network-detection sigma-rules snort suricata
Language:Python 2
Palantir-Threat-Detection
NemesisCyberForce / Palantir-Threat-Detection
**Palantir Threat Detection: Open SIEM Labs with Sigma Rules** This repository is intended for educational and research purposes only. It is not a 100% protection against Palantir-related activity or any other advanced threats. Security is about reducing risk, not eliminating it.
minerva palantir polis siem sigma-rules threat-detection threat-hunting threat-intelligence atlas-nexus bda-analytik vs-datarium cybersecurity redteam redteaming security elastic-security wazuh dfir osint splunk
Language:Python 2
pop-ecx / sigma_picker.nvim
Pick and convert to specific backends for sigma rules within neovim
lua neovim nvim nvim-plugin sigma-rules cybersecurity blueteam cyberdefense
Language:Lua 2
AndreSantagati / ETNA
🌋 ETNA - Enhanced Threat Network Analysis | Sicilian-inspired automated threat hunting platform with MITRE ATT&CK integration
blue-team cybersecurity mitre-attack security-automation sicily sigma-rules soc threat-hunting threat-intelligence
Language:Python 1
colvert-project / colvert
Manage your detection use cases portfolio
django django-application django-project management mitre-attack python python3 soc detection-use-cases colvert cert csirt csirt-activities csirt-tooling bootstrap5 siem siem-tools detection-rules sigma sigma-rules
Language:Python 1
ghoshzsh / active-directory-event-detection-handbook
The Active Directory Event Detection Guide is a comprehensive resource developed to enhance the detection and monitoring of critical Active Directory (AD) events using Splunk. This guide is intended for cybersecurity professionals, system administrators, and incident responders aiming to boost visibility into AD activities and strengthen their orga
active-directory powershell sigma-rules splunk caldera windows
1
GodFWarsion / RansomTrace
Ransomware Detection and Analysis Framework
csharp incident-response malware-analysis ransomware sigma-rules yara-rules
Language:C# 1
m4pol / hunting-rules-repository
This repository contains a collection of threat hunting rules.
threat-hunting threat-hunting-via-yara-rules yara sigma-rules
Language:YARA 1
picassoendless / healthcare-sigma-rules
This repository contains Sigma detection rules tailored to protect the healthcare sector from cyber threats such as ransomware, phishing, and insider attacks.
healthcare-ai powershell sigma-rules windows siem splunk
1
pop-ecx / sigma-ls
A minimal language server to help in writing sigma rules
language-server-protocol neovim sigma-rules lsp detection-engineering
Language:Python 1
vincenzocaputo / sigma-lookup
A Python command-line tool for quickly searching Sigma rules.
mitre-attack sigma-rules threat-hunting
Language:Python 1

sigma-rules

ion-storm / sysmon-config

wagga40 / Zircolite

Elemental-attack / Elemental

phish-report / IOK

krdmnbrk / AttackRuleMap

nasbench / SIGMA-Resources

blackberry / threat-research-and-intelligence

3CORESec / S2AN

AttackIQ / SigmAIQ

mthcht / ThreatHunting-Keywords-sigma-rules

u-siem / u-siem-core

sysflow-telemetry / sf-processor

marirs / sigma-convert

muchdogesec / sigma2stix

RussianPanda95 / Sigma-Rules

wikijm / ConvertSigmaRepo2SentinelOnePQ

dan21san / sigma-tactics-organizer

xFFninja / happy_threat_hunting

mf1d3l / HayabusaToWinEventLog

whichbuffer / Threat-Detection-Rules

bradleyjkemp / sigmadoc

j91321 / sigma-playground

sansan-monkey / hunting-rules

subhranshuchoudhury / sigma-rules-api

vVv-Keys / sigma-rules

arblade / nyx

NemesisCyberForce / Palantir-Threat-Detection

pop-ecx / sigma_picker.nvim

AndreSantagati / ETNA

colvert-project / colvert

ghoshzsh / active-directory-event-detection-handbook

GodFWarsion / RansomTrace

m4pol / hunting-rules-repository

picassoendless / healthcare-sigma-rules

pop-ecx / sigma-ls

vincenzocaputo / sigma-lookup