sysmon

There are 19 repositories under sysmon topic.

SigmaHQ / sigma
Main Sigma Rule Repository
elasticsearch ids logging monitoring security siem signatures splunk sysmon
Language:Python 9772
SwiftOnSecurity / sysmon-config
Sysmon configuration file template with default high-quality event tracing
logging monitoring netsec sysinternals sysmon threat-hunting threatintel windows
5246
WindowsSpyBlocker
crazy-max / WindowsSpyBlocker
Block spying and tracking on Windows
blocker dnscrypt firewall hostsfile ncsi openwrt proxifier qemu spy sysmon telemetry windows wireshark
Language:Go 4978
clong / DetectionLab
Automate the creation of a lab environment complete with security tooling and logging best practices
vagrant vagrantfile packer information-security lab-environment dfir terraform ansible powershell detection detectionlab osquery sysmon dfir-automation
Language:HTML 4854
OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
dfir hunter hunting hunting-campaigns hypothesis mitre mitre-attack-db sysmon threat-hunting
Language:Python 4378
olafhartong / sysmon-modular
A repository of sysmon configuration modules
sysmon dfir threat-hunting mitre-attack modular security-tools
Language:PowerShell 2896
nshalabi / SysmonTools
Utilities for Sysmon
sysmon threatintel sysinternals threat-hunting windows netsec monitoring logging threat-intelligence
1557
0xrawsec / whids
Open Source EDR for Windows
dfir threat-hunting windows ids sysmon edr
Language:Go 1281
sentinel-attack
netevert / sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
siem threat-hunting azure-sentinel mitre-attack sysmon sysmon-config azure blue-team cybersecurity logging security-tools detection kql workbooks terraform-azure
1073
MHaggis / sysmon-dfir
Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
sysmon
926
ion-storm / sysmon-config
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
sysmon threatintel threat-hunting netsec sysinternals logging graylog graylog-plugin dfir threat-intelligence threat-sharing threat-analysis mitre-attack digitalforensics forensic-analysis forensicartifacts forensics siem sigma-rules humio
Language:PowerShell 812
wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
sigma python3 evtx sigma-rules detection auditd sysmon pysigma evtxtract forensics forensics-tools
Language:Python 750
Yamato-Security / EnableWindowsLogSettings
Documentation and scripts to properly enable Windows event logs.
auditing dfir event forensics hayabusa logs monitoring security sigma sysmon windows
Language:Batchfile 639
RoomaSec / RmEye
戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
edr sysmon threat-hunting
Language:Python 526
JPCERTCC / SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
security kibana elasticsearch sysmon stix stix2
Language:JavaScript 425
wecooperate / iMonitorSDK
The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能，而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发
access-control defender edr endpoint-security etw kernel monitoring-tool procmon security sysmon zero-trust
Language:C++ 363
n0dec / MalwLess
Test Blue Team detections without running any attack.
blueteam dfir mitre-attack sysmon siem redteam powershell hacktoberfest
Language:C# 271
matterpreter / Shhmon
Neutering Sysmon via driver unload
csharp sysmon evasion
Language:C# 234
yarox24 / attack_monitor
Endpoint detection & Malware analysis software
endpoint-security malware-analysis security-tools sysmon
Language:Python 230
AustralianCyberSecurityCentre / windows_event_logging
Windows Event Forwarding subscriptions, configuration files and scripts that assist with implementing ACSC's protect publication, Technical Guidance for Windows Event Logging.
windows logging event-log wmi sysmon
Language:PowerShell 226
ion-storm / sysmon-edr
Sysmon EDR POC Build within Powershell to prove ability.
edr sysmon sysmon-edr
Language:PowerShell 226
ine-labs / ThreatSeeker
ThreatSeeker: Threat Hunting via Windows Event Logs
evtx log-analysis sysmon threat threat-detection threat-intelligence windows
Language:Python 123
jymcheong / SysmonResources
Consolidation of various resources related to Microsoft Sysmon & sample data/log
sysmon threat threat-hunting
Language:Python 118
0xrajneesh / Log-Analysis-Projects-for-Beginners
Hands-on cybersecurity training projects for beginners, focusing on vulnerability management, incident response, and log analysis
elasticsearch log-analysis sysmon
96
Hestat / ossec-sysmon
A Ruleset to enhance detection capabilities of Ossec using Sysmon
dfir ossec sysmon wazuh
Language:PowerShell 94
ScriptIdiot / SysmonQuiet
RDLL for Cobalt Strike beacon to silence sysmon process
cobaltstrike sysmon rdll redteam
Language:C 89
LaresLLC / SysmonConfigPusher
Pushes Sysmon Configs
sysmon threat-hunting windows siem
Language:C# 88
sametsazak / sysmon
Sysmon and wazuh integration with Sigma sysmon rules [updated]
wazuh sysmon ossec security-tools security sysmon-config wazuh-manager sigma
70
huoji120 / DuckSysEye
SysEye是一个window上的基于att&ck现代EDR设计**的威胁响应工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
edr osquery sysmon threat-hunting threat-modeling
63
MHaggis / sysmon-splunk-app
Sysmon Splunk App
sysmon splunk
47
signorrayan / Splunk-Threat-Hunting
This repository contains Splunk queries to hunt some anomalies
anomaly-detection dashboard fortigate splunk suricata sysmon threat-hunting zeek
44
MHaggis / app_splunk_sysmon_hunter
Splunk App to assist Sysmon Threat Hunting
sysmon splunk threat
38
bobby-tablez / Enable-All-The-Logs
This script enhances endpoint logging telemetry for the purpose of advanced malware threat detection or for building detections or malware analysis. This can be used in production, however you might want to tune the GPO edits as needed.
gpo lab log-analysis logging malware-analysis sysmon sysmon-config sysmon-logs windows
Language:PowerShell 35
jhochwald / Universal-Winlogbeat-configuration
Universal Winlogbeat configuration
examples filebeat filter graylog logging siem sysmon universal windows windows-10 windows-server winlogbeat yml
33
olafhartong / TA-Sysmon-deploy
Deploy and maintain Symon through the Splunk Deployment Sever
sysmon splunk-deployment splunk dfir threat-hunting
Language:Batchfile 30
Kara-4search / PEB-PPIDspoofing_Csharp
Command line & PPID spoofing
bypass sysmon csharp edr redteam pentest ppid avatar
Language:C# 27

sysmon

SigmaHQ / sigma

SwiftOnSecurity / sysmon-config

crazy-max / WindowsSpyBlocker

clong / DetectionLab

OTRF / ThreatHunter-Playbook

olafhartong / sysmon-modular

nshalabi / SysmonTools

0xrawsec / whids

netevert / sentinel-attack

MHaggis / sysmon-dfir

ion-storm / sysmon-config

wagga40 / Zircolite

Yamato-Security / EnableWindowsLogSettings

RoomaSec / RmEye

JPCERTCC / SysmonSearch

wecooperate / iMonitorSDK

n0dec / MalwLess

matterpreter / Shhmon

yarox24 / attack_monitor

AustralianCyberSecurityCentre / windows_event_logging

ion-storm / sysmon-edr

ine-labs / ThreatSeeker

jymcheong / SysmonResources

0xrajneesh / Log-Analysis-Projects-for-Beginners

Hestat / ossec-sysmon

ScriptIdiot / SysmonQuiet

LaresLLC / SysmonConfigPusher

sametsazak / sysmon

huoji120 / DuckSysEye

MHaggis / sysmon-splunk-app

signorrayan / Splunk-Threat-Hunting

MHaggis / app_splunk_sysmon_hunter

bobby-tablez / Enable-All-The-Logs

jhochwald / Universal-Winlogbeat-configuration

olafhartong / TA-Sysmon-deploy

Kara-4search / PEB-PPIDspoofing_Csharp