Alternatives and similar repositories for ThreatHunt:

Users that are interested in ThreatHunt are comparing it to the libraries listed below

• secprentice / PowerShellWatchlist
  List of PowerShell commands and commandlets that should be in your Powershel watchlist
  ☆37Updated 3 years ago
• OTRF / SimuLand
  Cloud Templates and scripts to deploy mordor environments
  ☆129Updated 3 years ago
• mvelazc0 / attack2jira
  attack2jira automates the process of standing up a Jira environment that can be used to track and measure ATT&CK coverage
  ☆111Updated last year
• MalwareArchaeology / ARTHIR
  ATT&CK Remote Threat Hunting Incident Response
  ☆200Updated 2 months ago
• 0xAnalyst / CB-Threat-Hunting
  ☆116Updated last year
• OTRF / Set-AuditRule
  Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity
  ☆90Updated 3 years ago
• miladaslaner / AdvHuntingCheatSheet
  Microsoft Threat Protection Advance Hunting Cheat Sheet
  ☆79Updated 4 years ago
• PSGumshoe / PSGumshoe
  ☆256Updated 2 months ago
• 3CORESec / S2AN
  S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator
  ☆85Updated 2 years ago
• swisscom / Invoke-Forensics
  Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.
  ☆112Updated last year
• littl3field / Audix
  Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
  ☆118Updated 5 years ago
• MHaggis / hunt-detect-prevent
  Lists of sources and utilities utilized to hunt, detect and prevent evildoers.
  ☆164Updated 6 years ago
• olafhartong / Presentations
  My conference presentations
  ☆66Updated last year
• picussecurity / picuslabs
  Picus Labs
  ☆44Updated 3 years ago
• mgreen27 / Invoke-LiveResponse
  Invoke-LiveResponse
  ☆146Updated 2 years ago
• P4T12ICK / Sigma-Hunting-App
  A Splunk App containing Sigma detection rules, which can be updated from a Git repository.
  ☆108Updated 5 years ago
• andreafortuna / autotimeliner
  Automagically extract forensic timeline from volatile memory dump
  ☆126Updated 9 months ago
• n0dec / MalwLess
  Test Blue Team detections without running any attack.
  ☆272Updated 9 months ago
• CyberMonitor / Invoke-Adversary
  Simulating Adversary Operations
  ☆92Updated 6 years ago
• sumeshi / evtx2es
  A library for fast parse & import of Windows Eventlogs into Elasticsearch.
  ☆85Updated 7 months ago
• theflakes / reg_hunter
  Blueteam operational triage registry hunting/forensic tool.
  ☆145Updated last year
• mvelazc0 / PurpleTeamPlaybook
  Active Directory Purple Team Playbook
  ☆105Updated last year
• tobor88 / PowerShell-Blue-Team
  Collection of PowerShell functinos and scripts a Blue Teamer might use
  ☆83Updated last year
• samratashok / Deploy-Deception
  A PowerShell module to deploy active directory decoy objects.
  ☆226Updated 5 years ago
• NVISOsecurity / evtx-hunter
  evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.
  ☆150Updated 3 years ago
• Infocyte / PSHunt
  Powershell Threat Hunting Module
  ☆282Updated 8 years ago
• mkorman90 / sysmon-config-bypass-finder
  Detect possible sysmon logging bypasses given a specific configuration
  ☆107Updated 6 years ago
• jwillyamz / ezEmu
  See adversary, do adversary: Simple execution of commands for defensive tuning/research (now with more ELF on the shelf)
  ☆102Updated 2 years ago
• CrowdStrike / xwf-yara-scanner
  ☆86Updated last year
• marcurdy / dfir-toolset
  Dump of organized knowledge on DFIR
  ☆133Updated 3 years ago