dfir-ronin / APT-OpenIOC-Detection-Rules
This repository contains OpenIOC rules to aid in hunting for indicators of compromise and TTPs focused on Advanced Persistent Threat groups.
☆20Updated last year
Related projects ⓘ
Alternatives and complementary repositories for APT-OpenIOC-Detection-Rules
- Library of threat hunts to get any user started!☆40Updated 4 years ago
- An Adaptive Misuse Detection System☆29Updated 2 weeks ago
- Helping Incident Responders hunt for potential persistence mechanisms on UNIX-based systems.☆15Updated last year
- yara detection rules for hunting with the threathunting-keywords project☆87Updated this week
- Placeholder for my detection repo and misc detection engineering content☆43Updated last year
- ☆41Updated 7 months ago
- Contains compiled binaries of Volatility☆29Updated last month
- Sigma detection rules for hunting with the threathunting-keywords project☆47Updated 2 weeks ago
- A project that aims to automate Volatility3 at scale with the use of cloud strength and the power of KQL inside ADX.☆15Updated 3 weeks ago
- Assist analyst and threat hunters to understand Windows authentication logs and to analyze brutforce scenarios.☆18Updated last year
- Living off the False Positive!☆29Updated 2 months ago
- ☆15Updated 2 weeks ago
- Threat Detection Rules (Snort/Sigma/Yara)☆13Updated 9 months ago
- Merge of two major cyber adversary datasets, MITRE ATT&CK and ETDA/ThaiCERT Threat Actor Cards, enabling victim/motivation-adversary-tech…☆50Updated 2 years ago
- A specification and style guide for YARA rules☆37Updated 9 months ago
- Modular malware analysis artifact collection and correlation framework☆52Updated 6 months ago
- A home for detection content developed by the delivr.to team☆59Updated last week
- CarbonBlack EDR detection rules and response actions☆71Updated 2 months ago
- Hundred Days of Yara Challenge☆12Updated 2 years ago
- 100 Days of YARA to be updated with rules & ideas as the year progresses☆56Updated last year
- ☆17Updated last year
- Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.☆76Updated 2 years ago
- Indicators of Compromise (IOCs) accompanying HP Threat Research blog posts and reports.☆29Updated 7 months ago
- ATT&CK Powered Suit is a browser extension that puts the complete MITRE ATT&CK® knowledge base at your fingertips with text search, conte…☆72Updated 2 weeks ago
- This repository is for Indicators of Compromise (IOCs) from Zscaler ThreatLabz public reports☆65Updated this week
- Jupyter Notebooks for Cyber Threat Intelligence☆35Updated last year
- Cloud, CDN, and marketing services leveraged by cybercriminals and APT groups☆57Updated 2 years ago
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆27Updated last month
- Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise☆57Updated 6 months ago
- Azure function to insert MISP data in to Azure Sentinel☆30Updated 2 years ago