Alternatives and similar repositories for Sigma-AWS

Users that are interested in Sigma-AWS are comparing it to the libraries listed below

• AppOmni-Labs / event-maturity-matrix
  The Event Maturity Matrix (EMM) is a comprehensive framework that provides clarity regarding the capabilities and nuances of SaaS audit l…
  ☆21Updated 9 months ago
• haidermdost / Threat-Detection-Maturity-Framework
  ☆18Updated 3 years ago
• invictus-ir / IOCs
  Invictus Threat Intelligence: IOCs and TTPs from blogs, research and more
  ☆11Updated last week
• threat-punter / detection-as-code-example
  A POC to implement Detection-as-Code with Terraform and Sumo Logic.
  ☆29Updated last year
• wiz-sec-public / wiz-research-iocs
  ☆40Updated this week
• securityjoes / Crowdstrike-Deploy
  The ultimate repository for remotely deploying Crowdstrike sensors quickly and discreetly on any other EDR platform.
  ☆23Updated this week
• schwartz1375 / Threat-Hunting-in-AWS
  ☆27Updated 2 years ago
• invictus-ir / aws-cheatsheet
  A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
  ☆74Updated last year
• w8mej / ThreatPlays
  Sharing Threat Hunting runbooks
  ☆25Updated 5 years ago
• BreakingMhet / honeyzure
  HoneyZure is a honeypot tool specifically designed for Azure environments, fully provisioned through Terraform. It leverages a Log Analyt…
  ☆16Updated 11 months ago
• Shuffle / workflows
  Workflows for Shuffle
  ☆23Updated 2 years ago
• blackbotsecurity / AWS-Attack
  AWSATT&CK adds MITRE ATT&CK context and additional logging capabilities to Rhino Security Labs's open-source AWS exploitation framework, …
  ☆45Updated 4 years ago
• blueteam0ps / det-eng-samples
  This repository contains sample log data that were collected after running adversary simulations in Microsoft 365
  ☆20Updated 7 months ago
• The-DFIR-Report / cyberchef-recipes
  ☆19Updated 3 years ago
• OktaSecurityLabs / CheatSheets
  ☆33Updated 7 years ago
• jshlbrd / detection-engineering-pocket-guide
  pocket guide for core detection engineering concepts
  ☆28Updated 2 years ago
• Permiso-io-tools / cloudtail
  ☆29Updated 6 months ago
• tropChaud / Cyber-Adversary-Heatmaps
  Intelligence around common attacker behaviors (MITRE ATT&CK TTPs), in the form of ATT&CK Navigator "layer" json files.
  ☆35Updated 2 years ago
• guardsight / gsvsoc_mission-model
  Incident Response Report Using GitHub-Sphinx
  ☆20Updated 5 years ago
• op7ic / Cloud-Investigate
  A preconfigured Windows-based system designed for rapid forensic investigations in both Azure and AWS.
  ☆39Updated last year
• center-for-threat-informed-defense / defending-iaas-with-attack
  Defending IaaS with ATT&CK is a project to create a collection of ATT&CK techniques relevant to a Linux IaaS environment, as well as a me…
  ☆14Updated this week
• Digital-Defense-Institute / triage.zip
  A preconfigured Velociraptor triage collector
  ☆52Updated last week
• DefensiveOrigins / DO-LAB
  ☆47Updated last month
• anvilogic-forge / armory
  Anvilogic Forge
  ☆104Updated last week
• HarshVaragiya / aws-redteam-kit
  A PoC to Simulate Ransomware Attack on AWS Environment
  ☆31Updated 7 months ago
• splunk / attack_range_cloud
  Attack Range to test detection against nativel serverless cloud services and environments
  ☆35Updated 3 years ago
• elastic / sans-dfir-2022
  Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"
  ☆11Updated 3 months ago
• aquia-inc / aws-guardduty-runbook-generator
  Generates runbooks for GuardDuty findings
  ☆35Updated 11 months ago
• maartengoet / notebooks
  Jupyter notebooks
  ☆25Updated 4 years ago
• tesorion / TCERT-Cumulonimbus-UAL_Extractor
  Cumulonimbus-UAL_Extractor is a PowerShell based tool created by the Tesorion CERT team to help gather the Unified Audit Logging out of a…
  ☆20Updated last year