Alternatives and similar repositories for detections

Users that are interested in detections are comparing it to the libraries listed below

• msdirtbag / azurevelo
  Velociraptor Server hosted in Azure App Service
  ☆54Updated this week
• olafhartong / DefenderHarvester
  Expose a lot of MDE telemetry that is not easily accessible in any searchable form
  ☆106Updated 5 months ago
• 0xAnalyst / DefenderATPQueries
  Hunting Queries for Defender ATP
  ☆82Updated last month
• DCScoder / ESXiTri
  ESXi Cyber Security Incident Response Script
  ☆22Updated 9 months ago
• Ruler-Project / ruler-project
  Remote access and Antivirus Logging Database
  ☆42Updated last year
• zolderio / misp-to-sentinel
  Azure function to insert MISP data in to Azure Sentinel
  ☆32Updated 2 years ago
• JeffMichelmore / MDEKit
  ☆41Updated last year
• MHaggis / ASRGEN
  ASR Configurator, Essentials and Atomic Testing
  ☆42Updated last month
• microsoft / tim-data-investigate-platform
  TIM is a Kusto investigation platform that enables a user to quickly pivot between data sources; annotate their findings; and promotes co…
  ☆22Updated 9 months ago
• invictus-ir / Blue-team-app-Office-365-and-Azure
  ☆72Updated 7 months ago
• keydet89 / Events-Ripper
  Project based on RegRipper, to extract add'l value/pivot points from TLN events file
  ☆85Updated 3 months ago
• eshlomo1 / MS-Defender-4-xOPS
  ☆17Updated 10 months ago
• m4nbat / KustQueryLanguage_kql
  Cyber Defence related kusto queries for use in Azure Sentinel and Defender advanced hunting
  ☆65Updated 2 months ago
• reprise99 / 4688-sysmon
  ☆62Updated last year
• biffalo / easy-wins-endpoint-defense
  Collection of scripts/resources/ideas for attack surface reduction and additional logging to enable better threat hunting on Windows endp…
  ☆38Updated last year
• jischell-msft / RemoteManagementMonitoringTools
  Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
  ☆88Updated 10 months ago
• svch0stz / velociraptor-detections
  ☆21Updated 2 years ago
• mr-r3b00t / KQL
  This is for my crappy (but hopefully useful) MDE and Sentinel KQL queries! #KQLThePlanet
  ☆12Updated 3 months ago
• CyberCX-DFIR / usnjrnl_rewind
  USN Journal full path builder
  ☆60Updated 8 months ago
• AndrewRathbun / DFIRPowerShellScripts
  Various PowerShells scripts I've made (or others have made) to automate some of the boring stuff in my everyday DFIR journey!
  ☆46Updated 8 months ago
• MagnetForensics / Magnet-RESPONSE-PowerShell
  PowerShell scripts for running Magnet RESPONSE forensic collection tool in large enterprises.
  ☆25Updated 4 months ago
• reversinglabs / reversinglabs-siem-rules
  A collection of various SIEM rules relating to malware family groups.
  ☆66Updated 11 months ago
• mgreen27 / mcp-velociraptor
  VelociraptorMCP is a Model Context Protocol bridge for exposing LLMs to MCP clients.
  ☆28Updated last week
• humio / security_monitoring
  ☆41Updated 2 years ago
• invictus-ir / o365_dataset
  A dataset containing Office 365 Unified Audit Logs for security research and detection
  ☆52Updated 2 years ago
• strozfriedberg / qelp
  Quick ESXi Log Parser
  ☆20Updated 5 months ago
• csababarta / memory-baseliner
  Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…
  ☆53Updated last year
• splunk / PEAK
  Security Content for the PEAK Threat Hunting Framework
  ☆29Updated last year
• NextronSystems / evtx-baseline
  A repository hosting example goodware evtx logs containing sample software installation and basic user interaction
  ☆78Updated 3 weeks ago
• Digital-Defense-Institute / triage.zip
  A preconfigured Velociraptor triage collector
  ☆52Updated last week