An index of publicly available and open-source threat detection rulesets.
☆136Apr 17, 2025Updated last year
Alternatives and similar repositories for Rulehound
Users that are interested in Rulehound are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- An OpenAI API Compatible Honeypot Gateway☆26Mar 17, 2025Updated last year
- Convert Sigma rules to SIEM queries, directly in your browser.☆121Jun 20, 2026Updated last month
- 🛡️Proactive ransomware defense for Windows, providing secure file hiding through camouflage, encrypted mappings, smart shortcuts and sea…☆16Oct 14, 2025Updated 9 months ago
- Mapping of open-source detection rules and atomic tests.☆214Jul 15, 2026Updated last week
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆182Updated this week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- PoC shadow SaaS and insecure credential detection system using a browser extension.☆45Jul 10, 2026Updated last week
- MCP (Model Context Protocol) Server for pycti☆15Jul 11, 2025Updated last year
- The Eventlog Compendium is the go-to resource for understanding Windows Event Logs.☆57Apr 22, 2025Updated last year
- 🖥️ Windows 🚀 A Windows tool for emergency privacy: instantly deletes sensitive data and active logins to protect my information during …☆55Jul 5, 2026Updated 2 weeks ago
- A Shodan-based tool to discover publicly exposed Ollama instances and list available LLM models.☆22May 27, 2025Updated last year
- A high-speed forensic timeline engine for Windows forensic artifact CSV output built for DFIR investigators. Quickly consolidate CSV outp…☆331Feb 26, 2026Updated 4 months ago
- WPAUDIT: Advanced WordPress security auditing suite & vulnerability scanner. Automates pentesting with Nmap, WPScan, Nuclei, SQLMap. Comp…☆38May 27, 2025Updated last year
- A public collection of detections designed to detect threats associated with the Okta WIC Platform.☆31Updated this week
- Velociraptor Server hosted in Azure App Service☆59Jun 4, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Feed it a number. Your cloned voice does the social engineering, while you sip your coffee. A ghost that talks on the phone for you.☆120Updated this week
- 🐻❄️ 🏹 Threat hunting with Polars and flaws.cloud AWS CloudTrail datasets.☆14May 22, 2024Updated 2 years ago
- Inboxfuscation is an advanced offensive & defensive framework for mailbox rule obfuscation and detection in Exchange environments.☆84Sep 11, 2025Updated 10 months ago
- Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation o…☆1,302Jul 11, 2026Updated last week
- SecureMCP is a security auditing tool designed to detect vulnerabilities and misconfigurations in applications using the [Model Context P…☆140Jun 7, 2025Updated last year
- AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. …☆113Jul 21, 2025Updated last year
- Save toil in security operations with: Detection & Intelligence Analysis for New Alerts (D.I.A.N.A. )☆224Sep 4, 2024Updated last year
- NOVA: The Prompt Pattern Matching☆153Updated this week
- Listener that spawns a new tmux window for each incoming reverse shell + Supports listening on many ports☆59Jul 13, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- This script analyzes the DCSync output file from several tools (such as Mimikatz, Secretsdump and SharpKatz...)☆71Mar 17, 2025Updated last year
- Secrets scanner with a twist... this is for getting threat actor credentials from MALWARE. Acquire TA creds from FLOSS exports, memdumps…☆37Jun 19, 2026Updated last month
- BlueSky OSINT Tool☆15Dec 10, 2024Updated last year
- 🛡️ SIGMA Detection Engineering Platform A comprehensive AI-powered detection engineering platform for security teams to explore MITRE AT…☆46Jun 28, 2025Updated last year
- DelePwn is a security assessment tool designed to identify and demonstrate the risks associated with Google Workspace Domain-Wide Delegat…☆41Aug 8, 2025Updated 11 months ago
- Fast and easy to use CLI-based file encryption program 📦☆13Oct 12, 2025Updated 9 months ago
- PowerShell tools to help defenders hunt smarter, hunt harder.☆488Oct 29, 2025Updated 8 months ago
- CRADLE is a collaborative platform for Cyber Threat Intelligence analysts. It streamlines threat investigations with integrated note-taki…☆343May 18, 2026Updated 2 months ago
- Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools…☆174Jul 14, 2026Updated last week
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Sublime rules for email attack detection, prevention, and threat hunting.☆369Updated this week
- A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concret…☆57Mar 5, 2026Updated 4 months ago
- ☆45Jul 17, 2025Updated last year
- BlackCat is a PowerShell module designed to validate the security of Microsoft Azure. It provides a set of functions to identify potentia…☆204Jun 24, 2026Updated 3 weeks ago
- A security analysis tool that identifies DNS queries made by browser extensions, empowering security teams to detect and investigate susp…☆190Feb 9, 2025Updated last year
- pocket guide for core detection engineering concepts☆31May 8, 2023Updated 3 years ago
- A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.☆275Sep 23, 2025Updated 10 months ago