32 production-quality KQL detection rules for Microsoft Sentinel, mapped to MITRE ATT&CK for Cloud, credential access, lateral movement, exfiltration, defense evasion, and more
☆15Aug 1, 2026Updated 2 months ago
Alternatives and similar repositories for kql-detection-rules
Users that are interested in kql-detection-rules are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Security content lifecycle management for Microsoft Sentinel and Microsoft Defender XDR.☆17Oct 18, 2026Updated last week
- Calculate distances between strings by how similar they look☆11Jan 28, 2024Updated 2 years ago
- Finds the detection rules in your SIEM that are running blind☆22Sep 6, 2026Updated last month
- Mishky's AD Range & The Escalation Path from Hell, Version 1.1☆13May 7, 2025Updated last year
- An introduction to detection engineering☆14Jan 3, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Links to malware-related YARA rules☆15Sep 29, 2022Updated 4 years ago
- Threat Hunting queries of multiple platforms☆86Updated this week
- Customized default website for Foscam network cameras.☆13Dec 18, 2017Updated 8 years ago
- .NetCore & AspNetCore API Building Blocks.☆12Aug 22, 2023Updated 3 years ago
- Automatic, fast parsing of browser artifacts☆17Jan 4, 2025Updated last year
- Command line utility to control gopro hero cameras using wifi☆11Jan 8, 2013Updated 13 years ago
- ☆21May 25, 2026Updated 5 months ago
- ☆13Jan 10, 2024Updated 2 years ago
- IOCs and notes related to malware☆28Jul 7, 2025Updated last year
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- CLI tool that explains CVEs in plain English and scans repos for impact. Powered by Claude.☆20May 12, 2026Updated 5 months ago
- Desktop KQL query builder for Microsoft security and Azure services - 52 tables across Defender, Sentinel, Entra ID, Azure Monitor, App I…☆47Jun 22, 2026Updated 4 months ago
- Scripts written in BASH, PowerShell, Python, and other languages.☆11Aug 5, 2023Updated 3 years ago
- A console/terminal server with logging facilities☆15Mar 4, 2015Updated 11 years ago
- Forensic Linux VM for Apple Silicon, ARM64 and x86-64 compatible platforms☆16Jul 17, 2026Updated 3 months ago
- Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection…☆36Oct 9, 2026Updated 2 weeks ago
- Solutions for COMP9021 Principles of Programming from UNSW.☆14Nov 20, 2023Updated 2 years ago
- Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.☆38Updated this week
- ☆24Dec 15, 2022Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- ☆11Jan 26, 2020Updated 6 years ago
- The All In One Script!☆10Feb 12, 2020Updated 6 years ago
- Repository to host automation for Cloud Labs☆32Jul 10, 2026Updated 3 months ago
- Bug Hunting Handbook☆12Aug 11, 2022Updated 4 years ago
- A public repository of quality research on cyber attack techniques. This is the backend for the Technique Research Report (TRR) Library.☆33Updated this week
- SigLens is a Windows binary analysis tool designed to pinpoint the exact regions responsible for antivirus detections. It narrows detecti…☆44Oct 1, 2026Updated 3 weeks ago
- ☆12May 13, 2024Updated 2 years ago
- ☆20Oct 23, 2020Updated 6 years ago
- Automated Malware Behavior Analysis Tool☆12May 13, 2026Updated 5 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Ansible playbook to convert Sigma rules to ElastAlert rules☆10Feb 5, 2021Updated 5 years ago
- Linux Persistence Detection, Hunting and Artifact Collection script☆28Jul 20, 2026Updated 3 months ago
- ☆22Jul 13, 2026Updated 3 months ago
- Open source HIDS tailored for Microsoft Windows and Active Directory☆31Jul 23, 2026Updated 3 months ago
- Rules Shared by the Community from 100 Days of YARA 2023☆79Apr 12, 2023Updated 3 years ago
- DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them agai…☆36Jul 28, 2026Updated 3 months ago
- Aftermath is a free macOS incident response framework☆35Sep 25, 2025Updated last year