SCILabsMX / yaraZeekAlertLinks
This script scans the files extracted by Zeek with YARA rules located on the rules folder on a Linux based Zeek sensor, if there is a match it sends email alerts to the email address specified in the mailTo parameter on yaraAlert.conf file. The alert includes network context of the file transfer and attaches the suspicious file if it is less tha…
☆62Updated 2 years ago
Alternatives and similar repositories for yaraZeekAlert
Users that are interested in yaraZeekAlert are comparing it to the libraries listed below
Sorting:
- Repository containing IOCs, CSV and MISP JSON from our blogs☆83Updated 4 years ago
- Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)☆103Updated 6 months ago
- Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings☆122Updated 4 years ago
- Sigma Detection Rule Repository☆92Updated 5 years ago
- A tool to assess data quality, built on top of the awesome OSSEM.☆80Updated 3 years ago
- Personal compilation of APT malware from whitepaper releases, documents and own research☆266Updated 7 years ago
- Import specific data sources into the Sigma generic and open signature format.☆79Updated 3 years ago
- S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator☆91Updated 3 years ago
- Collection of YARA signatures from individual research☆45Updated 2 years ago
- Threat Alert Logic Repository☆93Updated 7 years ago
- Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.☆109Updated 7 years ago
- ☆78Updated 5 years ago
- Log Entry to Sigma Rule Converter☆108Updated 3 years ago
- Collecting & Hunting for IOCs with gusto and style☆241Updated 4 years ago
- Random hunting ordiented yara rules☆98Updated 2 years ago
- Research indicators and detection rules☆67Updated 2 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆119Updated 5 years ago
- All the IOC's I have gathered which are used directly involved coronavirus / covid-19 / SARS-CoV-2 cyber attack campaigns☆65Updated 4 years ago
- Automatically create YARA rules from malicious documents.☆212Updated 3 years ago
- Mapping NSM rules to MITRE ATT&CK☆73Updated 5 years ago
- Graph Representation of MITRE ATT&CK's CTI data☆51Updated 6 years ago
- A Splunk app to use MISP in background☆113Updated last month
- Cloud Templates and scripts to deploy mordor environments☆129Updated 4 years ago
- This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant ya…☆122Updated 4 years ago
- FRAC and RIFT☆17Updated 6 years ago
- Mindmaps for threat hunting - work in progress.☆152Updated 3 years ago
- A website and framework for testing NIDS detection☆57Updated 4 years ago
- Valhalla API Client☆70Updated 2 weeks ago
- Open platform for modelling, collection and exchange of knowledge☆164Updated 8 months ago
- Repository of all the sites related to infosec IP/Domain/Hash/SSL/etc OSINT and eventually will include more.☆70Updated 3 months ago