Detection Rules

SigmaPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

Elastic Detection RulesPython

A public repository for developing, testing, and maintaining detection rules for Elastic Security's SIEM, with tools for Detections as Code.

DeepBlueCLIPowerShell

A PowerShell module for threat hunting and detecting malicious activity via Windows Event Logs.

KQL Advanced Hunting Queries & Analytics RulesPython

A collection of ready-to-use KQL queries for threat hunting, detection, and analytics in Microsoft Defender for Endpoint and Azure Sentinel.

Anvilogic Detection Armory

An open-source repository of cybersecurity detection rules and threat identifiers for security teams to enhance threat detection capabilities.

Exabeam Content Library

An online repository of Exabeam's security detection content, including data sources, use cases, and rules based on the Common Information Model 2.0.