Alternatives and similar repositories for endpoint

Users that are interested in endpoint are comparing it to the libraries listed below

• OTRF / OSSEM-DD
  OSSEM Data Dictionaries
  ☆60Updated 4 months ago
• NextronSystems / CyberChef
  CyberChef - Detection Engineering, TI, DFIR, Malware Analysis Edition
  ☆63Updated 2 years ago
• thremulation-station / thremulation-station
  Small-scale threat emulation and detection range built on Elastic and Atomic Redteam.
  ☆38Updated last year
• splunk / attack-detections-collector
  Collects a listing of MITRE ATT&CK Techniques, then discovers Splunk ESCU detections for each technique
  ☆67Updated last year
• NextronSystems / evtx-baseline
  A repository hosting example goodware evtx logs containing sample software installation and basic user interaction
  ☆78Updated 2 weeks ago
• RomaissaAdjailia / MindMaps
  ☆23Updated 3 years ago
• mitre / stockpile
  A CALDERA plugin
  ☆76Updated this week
• MHaggis / notes
  Full of public notes and Utilities
  ☆113Updated 3 months ago
• Neo23x0 / Talks
  Slides of my public talks
  ☆55Updated last year
• blacklanternsecurity / sigma-rules
  A collection of Sigma rules organized by MITRE ATT&CK technique
  ☆17Updated 3 years ago
• center-for-threat-informed-defense / attack-powered-suit
  ATT&CK Powered Suit is a browser extension that puts the complete MITRE ATT&CK® knowledge base at your fingertips with text search, conte…
  ☆78Updated this week
• darkquasar / AIMOD2
  Adversarial Interception Mission Oriented Discovery and Disruption Framework, or AIMOD2, is a structured threat hunting approach to proac…
  ☆88Updated last year
• MHaggis / ShellSweep
  ShellSweeping the evil.
  ☆52Updated 11 months ago
• SigmaHQ / pySigma-backend-splunk
  pySigma Splunk backend
  ☆38Updated 3 weeks ago
• HASecuritySolutions / LogCampaign
  Provides detection capabilities and log conversion to evtx or syslog capabilities
  ☆53Updated 2 years ago
• elastic / detection-rules-explorer
  ☆20Updated this week
• splunk / attack_range_cloud
  Attack Range to test detection against nativel serverless cloud services and environments
  ☆35Updated 3 years ago
• 3CORESec / Automata
  Automatic detection engineering technical state compliance
  ☆55Updated 10 months ago
• mitre / emu
  This CALDERA Plugin converts Adversary Emulation Plans from the Center for Threat Informed Defense
  ☆30Updated 2 months ago
• mitre / access
  A CALDERA plugin
  ☆22Updated 2 weeks ago
• mdecrevoisier / Splunk-input-windows-baseline
  Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE…
  ☆90Updated last week
• threat-punter / community-contributions
  A collection of my presentations, blog posts, and other contributions to the information security community
  ☆26Updated 2 weeks ago
• microsoft / MSTIC-Sysmon
  Anything Sysmon related from the MSTIC R&D team
  ☆153Updated 11 months ago
• OTRF / Set-AuditRule
  Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity
  ☆91Updated 3 years ago
• mvelazc0 / PurpleTeamPlaybook
  Active Directory Purple Team Playbook
  ☆108Updated 2 years ago
• iknowjason / BlueCloud
  Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.
  ☆133Updated 2 years ago
• sans-blue-team / sec555-wiki
  ☆77Updated 5 years ago
• jokezone / Update-Sysmon
  This repository was created to aid in the deployment/maintenance of the Sysmon service on a large number of computers.
  ☆82Updated 2 years ago
• svch0stz / TheThreatHuntLibrary
  Library of threat hunts to get any user started!
  ☆44Updated 4 years ago
• mitre / training
  A CALDERA plugin
  ☆26Updated 10 months ago