This repository contains the research and components of our research into using Sigma for AWS Incident Response.
☆38Jul 12, 2023Updated 3 years ago
Alternatives and similar repositories for Sigma-AWS
Users that are interested in Sigma-AWS are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A dataset with CloudTrail events from an attack simulation using Stratus.☆29Jul 12, 2023Updated 3 years ago
- Repository with supporting materials for Invictus Academy/Training☆45Jul 22, 2026Updated 3 months ago
- PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.☆13Aug 26, 2024Updated 2 years ago
- DFIR Reference☆11Jul 30, 2026Updated 3 months ago
- $I30 INDX Carver☆18Jun 23, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Assist analyst and threat hunters to understand Windows authentication logs and to analyze brutforce scenarios.☆21Jul 1, 2023Updated 3 years ago
- An evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real-world incidents, references and secur…☆177Oct 4, 2026Updated last month
- Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal☆21Oct 24, 2026Updated last week
- Disk Image Mounting Script☆14Jul 21, 2026Updated 3 months ago
- Spin up a fully configured, host‑only malware analysis lab with FlareVM, REMnux or CAPE Sandbox using a few repeatable commands.☆38Aug 15, 2026Updated 2 months ago
- ☆378Feb 23, 2024Updated 2 years ago
- OpenRelik worker to interact with a Timesketch server☆10Feb 14, 2026Updated 8 months ago
- A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of …☆207Aug 11, 2026Updated 2 months ago
- ☆10May 19, 2026Updated 5 months ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Generate realistic synthetic security logs for cybersecurity threat hunting training and research☆295Updated this week
- A comprehensive PowerShell toolkit for RDP forensics analysis, tracking connection attempts, authentication, sessions, and logoffs across…☆19Oct 7, 2026Updated 3 weeks ago
- Plugin for YATAS that audits AWS accounts for misconfiguration and security issues☆15Updated this week
- ☆41Aug 23, 2022Updated 4 years ago
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Feb 6, 2025Updated last year
- This script is used to generate some basic detections of the aws security services☆72Feb 21, 2022Updated 4 years ago
- Swift Command line tool used for proactive detection of malicious activity on macOS systems.☆70Jul 1, 2020Updated 6 years ago
- Public script from SANS FOR509 Enterprise Cloud Incident Response☆242Oct 26, 2025Updated last year
- Just Another broken Registry Parser (JARP)☆16May 23, 2024Updated 2 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- ☆159Jul 8, 2023Updated 3 years ago
- A unified investigation cockpit built for CSIRT / SOC / DFIR teams. Ingest, correlate and visualise any forensic source in a real-time in…☆45Updated this week
- Forensic cheatsheets for use with cheat☆16Dec 2, 2021Updated 4 years ago
- HoneyZure is a honeypot tool specifically designed for Azure environments, fully provisioned through Terraform. It leverages a Log Analyt…☆17Jun 11, 2024Updated 2 years ago
- Workflows for Shuffle☆25Oct 26, 2022Updated 4 years ago
- This repository contains generated contextual data utilized by pyattck.☆19Mar 3, 2025Updated last year
- ☆24Sep 7, 2026Updated last month
- ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit l…☆189Oct 29, 2026Updated last week
- ☆75Oct 21, 2024Updated 2 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Quick & Dirty DFIR scripts developed by Ebryx DFIR team to keep handy during field assignment☆14Jan 7, 2026Updated 9 months ago
- osquery input plugin☆10Oct 23, 2018Updated 8 years ago
- ☆27Aug 11, 2020Updated 6 years ago
- ☆40Oct 30, 2026Updated last week
- A public collection of detections designed to detect threats associated with the Okta WIC Platform.☆40Oct 30, 2026Updated last week
- Conditional Access baseline for March 2025☆12Mar 4, 2025Updated last year
- ☆16Updated this week