Detection Rules

SigmaPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

Elastic Detection RulesPython

A public repository for developing, testing, and maintaining detection rules for Elastic Security's SIEM, with tools for Detections as Code.

DeepBlueCLIPowerShell

A PowerShell module for threat hunting and detecting malicious activity via Windows Event Logs.

KQL Advanced Hunting Queries & Analytics RulesPython

A collection of ready-to-use KQL queries for threat hunting, detection, and analytics in Microsoft Defender for Endpoint and Azure Sentinel.