An index of publicly available and open-source threat detection rulesets.
☆141Apr 17, 2025Updated last year
Alternatives and similar repositories for Rulehound
Users that are interested in Rulehound are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- An OpenAI API Compatible Honeypot Gateway☆27Mar 17, 2025Updated last year
- 🛡️Proactive ransomware defense for Windows, providing secure file hiding through camouflage, encrypted mappings, smart shortcuts and sea…☆17Oct 14, 2025Updated 11 months ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆123Aug 19, 2026Updated last month
- MCP (Model Context Protocol) Server for pycti☆16Jul 11, 2025Updated last year
- The Eventlog Compendium is the go-to resource for understanding Windows Event Logs.☆58Apr 22, 2025Updated last year
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Mapping of open-source detection rules and atomic tests.☆217Jul 15, 2026Updated 2 months ago
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆224Oct 5, 2026Updated last week
- 🖥️ Windows 🚀 A Windows tool for emergency privacy: instantly deletes sensitive data and active logins to protect my information during …☆57Jul 5, 2026Updated 3 months ago
- PoC shadow SaaS and insecure credential detection system using a browser extension.☆44Aug 5, 2026Updated 2 months ago
- A Shodan-based tool to discover publicly exposed Ollama instances and list available LLM models.☆25May 27, 2025Updated last year
- WPAUDIT: Advanced WordPress security auditing suite & vulnerability scanner. Automates pentesting with Nmap, WPScan, Nuclei, SQLMap. Comp…☆41May 27, 2025Updated last year
- A public collection of detections designed to detect threats associated with the Okta WIC Platform.☆39Sep 8, 2026Updated last month
- 🐻❄️ 🏹 Threat hunting with Polars and flaws.cloud AWS CloudTrail datasets.☆15May 22, 2024Updated 2 years ago
- Velociraptor Server hosted in Azure App Service☆59Jun 4, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Feed it a number. Your cloned voice does the social engineering, while you sip your coffee. A ghost that talks on the phone for you.☆127Jul 20, 2026Updated 2 months ago
- Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation o…☆1,356Updated this week
- AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. …☆113Jul 21, 2025Updated last year
- Save toil in security operations with: Detection & Intelligence Analysis for New Alerts (D.I.A.N.A. )☆224Sep 4, 2024Updated 2 years ago
- NOVA: The Prompt Pattern Matching☆171Sep 22, 2026Updated 2 weeks ago
- Inboxfuscation is an advanced offensive & defensive framework for mailbox rule obfuscation and detection in Exchange environments.☆83Sep 11, 2025Updated last year
- BlueSky OSINT Tool☆16Dec 10, 2024Updated last year
- SecureMCP is a security auditing tool designed to detect vulnerabilities and misconfigurations in applications using the [Model Context P…☆140Jun 7, 2025Updated last year
- 🛡️ SIGMA Detection Engineering Platform A comprehensive AI-powered detection engineering platform for security teams to explore MITRE AT…☆46Jun 28, 2025Updated last year
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- Fast and easy to use CLI-based file encryption program☆12Aug 24, 2026Updated last month
- PowerShell tools to help defenders hunt smarter, hunt harder.☆490Oct 29, 2025Updated 11 months ago
- This script analyzes the DCSync output file from several tools (such as Mimikatz, Secretsdump and SharpKatz...)☆71Mar 17, 2025Updated last year
- Listener that spawns a new tmux window for each incoming reverse shell + Supports listening on many ports☆59Jul 13, 2025Updated last year
- A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concret…☆64Sep 28, 2026Updated last week
- A security analysis tool that identifies DNS queries made by browser extensions, empowering security teams to detect and investigate susp…☆188Feb 9, 2025Updated last year
- pocket guide for core detection engineering concepts☆31May 8, 2023Updated 3 years ago
- CRADLE is a collaborative platform for Cyber Threat Intelligence analysts. It streamlines threat investigations with integrated note-taki…☆342Updated this week
- Secrets scanner with a twist... this is for getting threat actor credentials from MALWARE. Acquire TA creds from FLOSS exports, memdumps…☆41Aug 9, 2026Updated 2 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Sublime rules for email attack detection, prevention, and threat hunting.☆378Updated this week
- Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools…☆184Aug 22, 2026Updated last month
- Web Server Vulnerability Scanning Tool☆37Mar 11, 2025Updated last year
- ☆22Apr 10, 2025Updated last year
- A starter pack of resources to help you get started in Detection Engineering.☆197Jun 4, 2026Updated 4 months ago
- BlackCat is a PowerShell module designed to validate the security of Microsoft Azure. It provides a set of functions to identify potentia…☆206Updated this week
- Generate datasets of cloud audit logs for common attacks☆246Sep 28, 2026Updated last week