bfuzzy/auditd-attack

Production-ready detection & response queries for osquery

Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!

Main Sigma Rule Repository

Small and highly portable detection tests based on MITRE's ATT&CK.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

DevSec Linux Baseline - InSpec Profile

Linux audit userspace repository