Alternatives and similar repositories for Sigma-AWS

Users that are interested in Sigma-AWS are comparing it to the libraries listed below

• Shuffle / workflows
  Workflows for Shuffle
  ☆23Updated 2 years ago
• haidermdost / Threat-Detection-Maturity-Framework
  ☆18Updated 4 years ago
• AppOmni-Labs / event-maturity-matrix
  The Event Maturity Matrix (EMM) is a comprehensive framework that provides clarity regarding the capabilities and nuances of SaaS audit l…
  ☆28Updated 3 months ago
• schwartz1375 / Threat-Hunting-in-AWS
  ☆31Updated 3 years ago
• threat-punter / detection-as-code-example
  A POC to implement Detection-as-Code with Terraform and Sumo Logic.
  ☆29Updated 2 years ago
• elastic / sans-dfir-2022
  Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"
  ☆11Updated 7 months ago
• Algbra-Labs-OSS / Chronicle
  ☆65Updated last year
• crypsisgroup / ebs-direct-sec-tools
  Fun tools around the EBS Direct API
  ☆19Updated 4 years ago
• jshlbrd / detection-engineering-pocket-guide
  pocket guide for core detection engineering concepts
  ☆30Updated 2 years ago
• invictus-ir / IOCs
  Invictus Threat Intelligence: IOCs and TTPs from blogs, research and more
  ☆22Updated 2 weeks ago
• wiz-sec-public / wiz-research-iocs
  ☆44Updated 2 months ago
• infosecB / detection-as-code
  An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
  ☆58Updated 3 years ago
• nidem / forgedpillow
  A tool to modify timestamps in a packet capture to a user selected date
  ☆31Updated 4 years ago
• piercing-index / cloud-vulnerabilities
  ☆41Updated 7 months ago
• blackbotsecurity / AWS-Attack
  AWSATT&CK adds MITRE ATT&CK context and additional logging capabilities to Rhino Security Labs's open-source AWS exploitation framework, …
  ☆46Updated 4 years ago
• Yamato-Security / suzaku-rules
  ☆11Updated this week
• op7ic / Cloud-Investigate
  A preconfigured Windows-based system designed for rapid forensic investigations in both Azure and AWS.
  ☆39Updated last year
• runreveal / sigmalite
  ☆49Updated last week
• Permiso-io-tools / cloudtail
  ☆30Updated 3 months ago
• anvilogic-forge / armory
  Anvilogic Forge
  ☆108Updated last week
• 3CORESec / Automata
  Automatic detection engineering technical state compliance
  ☆55Updated last year
• telekom-security / acquire-aws-ec2
  A python script to acquire multiple aws ec2 instances in a forensically sound-ish way
  ☆38Updated 3 years ago
• splunk / attack-detections-collector
  Collects a listing of MITRE ATT&CK Techniques, then discovers Splunk ESCU detections for each technique
  ☆67Updated last year
• center-for-threat-informed-defense / defending-iaas-with-attack
  Defending IaaS with ATT&CK is a project to create a collection of ATT&CK techniques relevant to a Linux IaaS environment, as well as a me…
  ☆14Updated 4 months ago
• BreakingMhet / honeyzure
  HoneyZure is a honeypot tool specifically designed for Azure environments, fully provisioned through Terraform. It leverages a Log Analyt…
  ☆16Updated last year
• w8mej / ThreatPlays
  Sharing Threat Hunting runbooks
  ☆25Updated 6 years ago
• cado-security / AWS_EKS_Cluster_Forensics
  AWS EKS Cluster Forensics
  ☆23Updated 4 years ago
• vz-risk / flow
  Tools related to work with Attack Flow (https://github.com/center-for-threat-informed-defense/attack-flow)
  ☆44Updated 3 years ago
• splunk / attack_range_cloud
  Attack Range to test detection against nativel serverless cloud services and environments
  ☆35Updated 4 years ago
• mattreduce / cti-self-study
  Track progress and keep notes while working through likethecoins' CTI Self Study Plan
  ☆29Updated 3 years ago