Alternatives and similar repositories for EDR-Telemetry

Users that are interested in EDR-Telemetry are comparing it to the libraries listed below

• redcanaryco / invoke-atomicredteam
  Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red…
  ☆906Updated 2 weeks ago
• FalconForceTeam / FalconFriday
  Hunting queries and detections
  ☆796Updated 4 months ago
• mdecrevoisier / EVTX-to-MITRE-Attack
  Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
  ☆567Updated 4 months ago
• Yamato-Security / EnableWindowsLogSettings
  Documentation and scripts to properly enable Windows event logs.
  ☆610Updated last year
• ScarredMonk / SysmonSimulator
  Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…
  ☆850Updated 3 years ago
• Bert-JanP / Hunting-Queries-Detection-Rules
  KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunt…
  ☆1,448Updated this week
• Neo23x0 / sysmon-config
  Sysmon configuration file template with default high-quality event tracing
  ☆484Updated last year
• Cyb3r-Monk / Threat-Hunting-and-Detection
  Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
  ☆727Updated 2 months ago
• cyb3rfox / Aurora-Incident-Response
  Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
  ☆903Updated last year
• rabobank-cdc / DeTTECT
  Detect Tactics, Techniques & Combat Threats
  ☆2,155Updated last week
• trustedsec / SysmonCommunityGuide
  TrustedSec Sysinternals Sysmon Community Guide
  ☆1,214Updated 11 months ago
• scythe-io / purple-team-exercise-framework
  Purple Team Exercise Framework
  ☆701Updated last year
• 0xrawsec / whids
  Open Source EDR for Windows
  ☆1,236Updated 2 years ago
• Bert-JanP / Incident-Response-Powershell
  PowerShell Digital Forensics & Incident Response Scripts.
  ☆596Updated last month
• elastic / protections-artifacts
  Elastic Security detection content for Endpoint
  ☆1,193Updated last week
• mthcht / ThreatHunting-Keywords
  Awesome list of keywords and artifacts for Threat Hunting sessions
  ☆569Updated 3 weeks ago
• sbousseaden / EVTX-ATTACK-SAMPLES
  Windows Events Attack Samples
  ☆2,356Updated 2 years ago
• dafthack / GraphRunner
  A Post-exploitation Toolset for Interacting with the Microsoft Graph API
  ☆1,094Updated 6 months ago
• olafhartong / sysmon-modular
  A repository of sysmon configuration modules
  ☆2,774Updated 8 months ago
• stuhli / awesome-event-ids
  Collection of Event ID ressources useful for Digital Forensics and Incident Response
  ☆615Updated 10 months ago
• ch33r10 / EnterprisePurpleTeaming
  Purple Team Resources for Enterprise Purple Teaming: An Exploratory Qualitative Study by Xena Olsen.
  ☆651Updated last year
• wagga40 / Zircolite
  A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
  ☆712Updated last month
• invictus-ir / Microsoft-Extractor-Suite
  A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
  ☆624Updated last week
• last-byte / PersistenceSniper
  Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows…
  ☆1,988Updated 5 months ago
• mdecrevoisier / Microsoft-eventlog-mindmap
  Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...
  ☆1,075Updated 8 months ago
• mdecrevoisier / SIGMA-detection-rules
  Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques
  ☆357Updated 4 months ago
• splunk / attack_range
  A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data int…
  ☆2,283Updated this week
• executemalware / Malware-IOCs
  ☆515Updated 7 months ago
• center-for-threat-informed-defense / adversary_emulation_library
  An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
  ☆1,887Updated last year
• ahmedkhlief / APT-Hunter
  APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the …
  ☆1,334Updated 6 months ago