Threat Detection & Anomaly Detection rules for popular open-source components
☆53Jul 27, 2022Updated 3 years ago
Alternatives and similar repositories for threat-detection-rules
Users that are interested in threat-detection-rules are comparing it to the libraries listed below
Sorting:
- SIEGMA - Transform Sigma rules into SIEM consumables☆159Mar 10, 2025Updated 11 months ago
- Threat Feeds, Threat lists, and regular lists of known IP ranges and domains. It updates every 4 hours.☆16May 21, 2021Updated 4 years ago
- Sigma Detection Rule Repository☆92Jun 18, 2020Updated 5 years ago
- An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.☆60Mar 12, 2022Updated 3 years ago
- Small-scale threat emulation and detection range built on Elastic and Atomic Redteam.☆39Dec 17, 2025Updated 2 months ago
- An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and vide…☆49Nov 11, 2022Updated 3 years ago
- Cyber Threats Detection Rules☆14Sep 16, 2025Updated 5 months ago
- Bring Your Own Mitre Att&ck © Matrix !☆13Oct 19, 2023Updated 2 years ago
- ☆28Nov 25, 2025Updated 3 months ago
- ☆21May 19, 2016Updated 9 years ago
- Knowledge base of analytics designed to cover threats based on MITRE's ATT&CK.☆23Dec 13, 2018Updated 7 years ago
- Splunk code (SPL) for serious threat hunters and detection engineers.☆290Jan 15, 2024Updated 2 years ago
- A POC to implement Detection-as-Code with Terraform and Sumo Logic.☆31Jul 27, 2023Updated 2 years ago
- Import specific data sources into the Sigma generic and open signature format.☆79May 6, 2022Updated 3 years ago
- This repository contains Splunk queries to hunt some anomalies☆46Jul 28, 2022Updated 3 years ago
- ☆20Jan 12, 2022Updated 4 years ago
- Sigma rules to share with the community☆124Jan 29, 2025Updated last year
- Collection of Suricata rule sets that I use modified to my environments.☆39Sep 13, 2020Updated 5 years ago
- Contains research.splunk.com site code☆11Apr 10, 2024Updated last year
- Cybersecurity Ontology (CyberOnto) and Situational Awareness (CyberSA) help teamwork in Cyber Incident Responses, Control, Containment, a…☆10Sep 15, 2022Updated 3 years ago
- Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques☆413Nov 8, 2025Updated 3 months ago
- Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise☆68Apr 29, 2024Updated last year
- Collection of example YARA-L rules for use within Google Security Operations☆473Dec 5, 2025Updated 3 months ago
- Active Response plugin. Osquery to execute wazuh/ossec active response plugins. You can write your own plugins, easy to plug☆11Jun 20, 2020Updated 5 years ago
- 🦉🔬A small PowerShell tool for finding information quickly on malicious IPs or FQDNs. Powershell threat hunting.☆11Jan 9, 2020Updated 6 years ago
- FIles and guides related to using Elasticstack as a SIEM☆12May 16, 2020Updated 5 years ago
- A Sigma based detection pipeline☆13Dec 15, 2023Updated 2 years ago
- This directory contains random scripts from threat hunting or malware research☆11Feb 15, 2018Updated 8 years ago
- Pritunl Access Control System☆10Feb 16, 2023Updated 3 years ago
- 🌦️ Domain Ranker☆16Sep 7, 2019Updated 6 years ago
- Snort_rules detection bad actors.☆29Aug 18, 2024Updated last year
- ☆35Jun 22, 2021Updated 4 years ago
- Detection Engineering research, open-source tools, conference presentations, and technical publications shared with the security communit…☆28Dec 17, 2025Updated 2 months ago
- Unofficial third-party scripts, playbooks, and content for IBM QRadar & QRadar Community Edition.☆87May 8, 2025Updated 9 months ago
- An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and vide…☆57Jan 16, 2023Updated 3 years ago
- [ARCHIVED -- USE TXT2DETECTION] A command line tool that converts Sigma Rules into STIX 2.1 Objects.☆12Feb 19, 2026Updated 2 weeks ago
- The intake formats supported by SEKOIA.IO☆18Updated this week
- certstream + analytics☆11Jan 17, 2020Updated 6 years ago
- Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs☆55Jul 20, 2023Updated 2 years ago