SCILabsMX / yaraZeekAlertLinks
This script scans the files extracted by Zeek with YARA rules located on the rules folder on a Linux based Zeek sensor, if there is a match it sends email alerts to the email address specified in the mailTo parameter on yaraAlert.conf file. The alert includes network context of the file transfer and attaches the suspicious file if it is less tha…
☆62Updated last year
Alternatives and similar repositories for yaraZeekAlert
Users that are interested in yaraZeekAlert are comparing it to the libraries listed below
Sorting:
- S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator☆87Updated 2 years ago
- Sigma Detection Rule Repository☆89Updated 5 years ago
- A tool to assess data quality, built on top of the awesome OSSEM.☆78Updated 3 years ago
- Repository containing IOCs, CSV and MISP JSON from our blogs☆81Updated 4 years ago
- Automatically create YARA rules from malicious documents.☆211Updated 3 years ago
- Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)☆102Updated last month
- Log Entry to Sigma Rule Converter☆108Updated 3 years ago
- Import specific data sources into the Sigma generic and open signature format.☆78Updated 3 years ago
- Place for resources used during the Mordor Detection hackathon event featuring APT29 ATT&CK evals datasets☆139Updated 4 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆118Updated 4 years ago
- ☆116Updated last year
- Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings☆121Updated 4 years ago
- Cloud Templates and scripts to deploy mordor environments☆129Updated 4 years ago
- Research indicators and detection rules☆67Updated last year
- Threat Alert Logic Repository☆92Updated 6 years ago
- Mapping NSM rules to MITRE ATT&CK☆71Updated 4 years ago
- ☆77Updated 5 years ago
- Random hunting ordiented yara rules☆97Updated 2 years ago
- Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.☆109Updated 7 years ago
- A Splunk app to use MISP in background☆111Updated 3 weeks ago
- Collecting & Hunting for IOCs with gusto and style☆241Updated 4 years ago
- All the IOC's I have gathered which are used directly involved coronavirus / covid-19 / SARS-CoV-2 cyber attack campaigns☆65Updated 4 years ago
- Simple yara rule manager☆66Updated 2 years ago
- This program exports MITRE ATT&CK framework in ELK dashboard☆79Updated 2 years ago
- A community event for security researchers to share their favorite notebooks☆108Updated last year
- Primary data pipelines for intrusion detection, security analytics and threat hunting☆87Updated 3 years ago
- ☆175Updated last year
- Collection of useful, up to date, Carbon Black Response Queries☆84Updated 4 years ago
- SIGMA UI is a free open-source application based on the Elastic stack and Sigma Converter (sigmac)☆189Updated 4 years ago
- Personal compilation of APT malware from whitepaper releases, documents and own research☆261Updated 6 years ago