Threat hunting queries, Sigma rules, and detection engineering research based on MITRE ATT&CK techniques.
☆75Oct 15, 2026Updated last week
Alternatives and similar repositories for threat-hunting-detections
Users that are interested in threat-hunting-detections are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆21Sep 11, 2026Updated last month
- Detection engineering with durable memory, a five-stage lifecycle, and an agentic surface — the sibling of ATHF.☆33Oct 14, 2026Updated last week
- A command line process execution monitor for Windows.☆17Sep 2, 2026Updated last month
- Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineer…☆60Oct 15, 2026Updated last week
- A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concret…☆65Sep 28, 2026Updated 3 weeks ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Adversarial Detection Engineering knowledge base — ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-t…☆84Sep 30, 2026Updated 3 weeks ago
- ☆22Jul 13, 2026Updated 3 months ago
- Community-driven PowerShell detection indicators☆46Jan 27, 2026Updated 8 months ago
- Valhuntir CLI — AI-augmented incident response platform☆138Updated this week
- A threat hunting process☆144Oct 2, 2026Updated 3 weeks ago
- [ARCHIVED] Public objects moved to OpenTideHQ/library☆17Sep 9, 2026Updated last month
- ☆91Sep 25, 2026Updated 3 weeks ago
- Automated Powershell Script to export NessusPro V7 or Nessus IO Scanner Reports - Nessus API☆11Dec 8, 2021Updated 4 years ago
- Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Pyth…☆28Sep 28, 2026Updated 3 weeks ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Command and Control Framework using powershell implants☆36Jun 17, 2025Updated last year
- Microsoft Sentinel SIEM Log Source Analyzer☆31Updated this week
- [ARCHIVED] Engine is now OpenTideHQ/opentide — DetectionOps as a package☆38Sep 9, 2026Updated last month
- Generate realistic synthetic security logs for cybersecurity threat hunting training and research☆287Updated this week
- Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence tab…☆42Oct 15, 2026Updated last week
- Track C2 servers, tools, and botnets over time by framework and location☆16Aug 17, 2025Updated last year
- A 'code-mode' MCP server that allows LLMs to safely generate and execute JavaScript code that performs forensic analysis and employs trad…☆38Aug 27, 2026Updated last month
- ☆22Oct 11, 2026Updated last week
- ☆19Updated this week
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Open-source desktop workbench for digital forensic analysis. Inspect ZIP/TAR/7z/UFDR archives, raw disk images/EWF, and iTunes/Android ba…☆102Updated this week
- Ludus range for the Constructing Defense Lab☆139Jul 28, 2026Updated 2 months ago
- A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening …☆37Oct 7, 2026Updated 2 weeks ago
- Sysmon Config Pusher - Modernized☆46Jan 7, 2026Updated 9 months ago
- A monthly Windows PE baseline dataset for Cyber security researchers☆24Sep 27, 2026Updated 3 weeks ago
- DFIR forensics companion server + capture extension☆32Oct 14, 2026Updated last week
- ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.☆396Updated this week
- Shattering the 1:10 barrier. A high-velocity alternative to Plaso for the modern IR landscape☆18Jul 6, 2026Updated 3 months ago
- Prevention-focused living-off-the-land testing framework mapped to MITRE ATT&CK.☆29Jul 24, 2026Updated 2 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Open-source PowerShell toolkit for Microsoft 365 security investigations - Read-only compromise assessment☆86Mar 9, 2026Updated 7 months ago
- Construct triage artifact based on rules☆17Oct 14, 2026Updated last week
- An Open Harness and Benchmark for AI in Cybersecurity Operations.☆67Updated this week
- A modern C2 framework for authorized red team operations☆16Updated this week
- MCP to help Defenders Detection Engineer Harder and Smarter☆498Jun 16, 2026Updated 4 months ago
- KQLIntel is a browser-based tool that uses LLMs to convert threat intelligence reports into actionable Kusto Query Language (KQL) queries…☆31Aug 4, 2025Updated last year
- CPENT to LPT CheatSheet☆32Apr 21, 2025Updated last year