Threat hunting queries, Sigma rules, and detection engineering research based on MITRE ATT&CK techniques.
☆75Oct 27, 2026Updated 2 weeks ago
Alternatives and similar repositories for threat-hunting-detections
Users that are interested in threat-hunting-detections are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆21Sep 11, 2026Updated 2 months ago
- A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concret…☆67Oct 29, 2026Updated 2 weeks ago
- Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard☆20Nov 4, 2026Updated last week
- ☆22Jul 13, 2026Updated 3 months ago
- DFIR Reference☆11Jul 30, 2026Updated 3 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Community-driven PowerShell detection indicators☆47Jan 27, 2026Updated 9 months ago
- Generate realistic synthetic security logs for cybersecurity threat hunting training and research☆299Updated this week
- A fast, native desktop workbench for Azure Data Explorer☆14Updated this week
- [ARCHIVED] Public objects moved to OpenTideHQ/library☆17Sep 9, 2026Updated 2 months ago
- KQLIntel is a browser-based tool that uses LLMs to convert threat intelligence reports into actionable Kusto Query Language (KQL) queries…☆31Updated this week
- Valhuntir CLI — AI-augmented incident response platform☆150Updated this week
- Automated Powershell Script to export NessusPro V7 or Nessus IO Scanner Reports - Nessus API☆11Dec 8, 2021Updated 4 years ago
- A command line process execution monitor for Windows.☆17Sep 2, 2026Updated 2 months ago
- Open, practitioner-maintained Detection Engineering curriculum.☆23Nov 5, 2026Updated last week
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineer…☆60Oct 15, 2026Updated 3 weeks ago
- ☆94Sep 25, 2026Updated last month
- Rust-based Fast Forensics Tool for Windows☆15Aug 9, 2026Updated 3 months ago
- Python for Defenders Course Resources☆21Oct 8, 2026Updated last month
- Detection engineering with durable memory, a five-stage lifecycle, and an agentic surface — the sibling of ATHF.☆37Updated this week
- Get-NetScalerTimeline - Automated File System Timeline Creation for NetScaler ADC/Gateway (DFIR)☆15Oct 4, 2026Updated last month
- Mapping of open-source detection rules and atomic tests.☆218Jul 15, 2026Updated 3 months ago
- Adversarial Detection Engineering knowledge base — ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-t…☆88Sep 30, 2026Updated last month
- Command and Control Framework using powershell implants☆36Jun 17, 2025Updated last year
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Microsoft Sentinel SIEM Log Source Analyzer☆31Oct 27, 2026Updated 2 weeks ago
- Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups …☆51Updated this week
- Attack Simulation Platform (ASP) for detection testing☆14Updated this week
- MCP to help Defenders Detection Engineer Harder and Smarter☆525Nov 4, 2026Updated last week
- [ARCHIVED] Engine is now OpenTideHQ/opentide — DetectionOps as a package☆38Sep 9, 2026Updated 2 months ago
- LotL RMM☆417Nov 5, 2026Updated last week
- Have you ever wanted to search a link or IP address on multiple OSINT pages at once?☆69Jul 7, 2025Updated last year
- ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.☆411Updated this week
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Feb 6, 2025Updated last year
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- A threat hunting process☆153Nov 4, 2026Updated last week
- A lightning-fast, lightweight DFIR triage and threat hunting engine for Windows Minidumps (.DMP).☆20Oct 2, 2026Updated last month
- Open-source desktop workbench for digital forensic analysis. Inspect ZIP/TAR/7z/UFDR archives, raw disk images/EWF, and iTunes/Android ba…☆112Updated this week
- A agentic Intel to hunt pipeline. Get hunting faster☆16Oct 19, 2026Updated 3 weeks ago
- ☆22Oct 11, 2026Updated last month
- Native sigma scanner for Linux logs☆18Updated this week
- Track C2 servers, tools, and botnets over time by framework and location☆16Aug 17, 2025Updated last year
Are these results useful?