28 results for “topic:detection-rules”
Marble - the real time decision engine for fraud and AML
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code.
The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.
The Web Exploit Detector is a Node.js application used to detect possible infections, malicious code and suspicious files in web hosting environments
Hunting Queries for Defender ATP
Sigma detection rules for hunting with the threathunting-keywords project
Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs
Sentrilite is a Cloud Runtime Threat Detection & Active Response against Zero-Day Attacks
No description provided.
Check Sigma rules for easy-to-bypass whitelists to make them more robust (https://github.com/SigmaHQ/sigma)
A userscript that enhances the SentinelOne PowerQuery interface with a custom threat hunting button that follow the website UI / UX design interface.
Docker Container for Elastic Detection CLI
A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.
A collection of custom-built dashboards for threat hunting.
An API that takes a txt file containing threat intelligence and turns it into a detection rule.
Files for the lab of Digital Communications at the University of Seville.
uberAgent configuration: UXM settings & ESA rules + checks
This repo, focuses on detection engineering for Kubernetes Cluster. Sysdig Falco is used to create rules.
Manage your detection use cases portfolio
A curated list of Awesome Detection Rules
Jibril public security detection recipes.
Fast DFIR toolkit built for high-volume EVTX and log analysis, delivering rapid parsing, detection-driven triage, timeline reconstruction, and case-ready reporting.
POC framework for detecting LOLBin abuse in Sysmon logs using Splunk SPL. Implements 12 layered checks (signature matching, parent-child anomalies, threat intel, statistical baselines) with risk scoring for automated alert prioritization. Supports standalone Splunk or distributed n8n architecture.
This detection engineering repo is for the Detection as Code CI/CD pipeline
Jibril Runtime Security Public Types. Important for unmarshalling events and similar needs.
Regex patterns for detecting ClickFix social engineering attacks
No description provided.
Wireshark-color-filters for network scanning packets scanning easy to understand attack patterns