APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
☆1,430Sep 20, 2026Updated 3 weeks ago
Alternatives and similar repositories for APT-Hunter
Users that are interested in APT-Hunter are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Windows Events Attack Samples☆2,637Jan 24, 2023Updated 3 years ago
- Rapidly Search and Hunt through Windows Forensic Artefacts☆3,695Updated this week
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆862Updated this week
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,402Updated this week
- Investigate malicious Windows logon by visualizing and analyzing Windows event log☆3,289Aug 2, 2026Updated 2 months ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Collection of Event ID ressources useful for Digital Forensics and Incident Response☆665Jun 19, 2024Updated 2 years ago
- WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）☆776Feb 3, 2023Updated 3 years ago
- A toolset to make a system look as if it was the victim of an APT attack☆2,780Sep 23, 2025Updated last year
- Scan files or process memory for CobaltStrike beacons and parse their configuration☆916Aug 19, 2021Updated 5 years ago
- ☆1,133Dec 19, 2023Updated 2 years ago
- Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).☆824Aug 14, 2026Updated 2 months ago
- Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, M…☆4,132Sep 22, 2026Updated 3 weeks ago
- ☆2,439Oct 14, 2023Updated 3 years ago
- Defences against Cobalt Strike☆1,304Jul 14, 2022Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows…☆2,140Dec 11, 2024Updated last year
- Interesting APT Report Collection And Some Special IOCs☆3,100Updated this week
- Utilities for Sysmon☆1,668Apr 4, 2026Updated 6 months ago
- A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more e…☆4,690Jan 12, 2026Updated 9 months ago
- Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.☆644May 21, 2026Updated 4 months ago
- Open Source EDR for Windows☆1,319Feb 25, 2023Updated 3 years ago
- Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders☆1,085Oct 5, 2023Updated 3 years ago
- Main Sigma Rule Repository☆11,261Updated this week
- Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…☆871Jan 20, 2022Updated 4 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Threat Hunting tool about Sysmon and graphs☆341May 28, 2023Updated 3 years ago
- A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365☆795Oct 29, 2022Updated 3 years ago
- Documentation and scripts to properly enable Windows event logs.☆723Oct 3, 2025Updated last year
- Detect Tactics, Techniques & Combat Threats☆2,349Updated this week
- Elastic Security detection content for Endpoint☆1,500Updated this week
- A repository of DFIR-related Mind Maps geared towards the visual learners!☆554Sep 2, 2022Updated 4 years ago
- Loki - Simple IOC and YARA Scanner☆3,801Jan 12, 2026Updated 9 months ago
- DFIRTrack - The Incident Response Tracking Application☆540Jan 13, 2026Updated 9 months ago
- Digging Deeper....☆4,350Updated this week
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A repository of sysmon configuration modules☆3,158Updated this week
- Small and highly portable detection tests based on MITRE's ATT&CK.☆12,691Updated this week
- Re-play Security Events☆1,835Mar 20, 2024Updated 2 years ago
- Hunts out CobaltStrike beacons and logs operator command output☆960Sep 4, 2024Updated 2 years ago
- Misc Threat Hunting Resources☆376Jan 26, 2023Updated 3 years ago
- A curated list of tools for incident response☆9,461Updated this week
- Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.☆1,357Dec 13, 2022Updated 3 years ago