Threat Detection

Atomic Red TeamC

A library of portable detection tests mapped to the MITRE ATT&CK framework for security testing.

Sigma RulesPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

HoneypotsPython

A curated list of awesome honeypot resources, tools, and related components for cybersecurity research and defense.

YARAC

A pattern-matching tool for malware researchers to identify and classify malware samples using custom rules.

Sysdig FalcoC++

A cloud native runtime security tool for Linux that detects abnormal behavior and security threats in real-time.

MaltrailPython

A malicious traffic detection system that monitors network traffic for blacklisted threats and suspicious activities using public feeds and heuristics.

sysmon-config

A high-quality, commented Sysmon configuration template for Windows system monitoring and incident investigation.

ThreatMapperTypeScript

Open source CNAPP that hunts for threats in cloud native platforms, ranks them by risk, and visualizes attack paths.

Awesome Threat Detection and Hunting

A curated list of awesome open-source tools, detection rules, datasets, and resources for threat detection and hunting.

Awesome YARA

A curated list of awesome YARA rules, tools, and resources for malware researchers and security professionals.

LogonTracerPython

A security tool that visualizes and analyzes Windows Active Directory event logs to investigate malicious logon activity.

sysmon-modularPowerShell

A modular repository of Sysmon configuration modules for customizable endpoint detection and logging.

OpenCanaryPython

A modular, low-resource network honeypot that mimics services to detect breaches and alert on attacker interactions.

APTSimulatorBatchfile

A Windows Batch script toolset that simulates Advanced Persistent Threat (APT) attack indicators to test security monitoring and detection capabilities.

Elastic Detection RulesPython

A public repository for developing, testing, and maintaining detection rules for Elastic Security's SIEM, with tools for Detections as Code.

Windows Events Attack SamplesHTML

A collection of 200 Windows EVTX event log samples mapped to MITRE ATT&CK techniques for detection testing and threat hunting.

FibratusGo

A Windows security tool for real-time adversary tradecraft detection, memory scanning, and forensics via behavior-driven rules.

BeelzebubGo

A secure low-code honeypot framework that uses AI to create high-interaction decoy systems for cyber attack detection and analysis.

JA4+Rust

A suite of network fingerprinting standards for TLS, TCP, HTTP, SSH, and other protocols to facilitate threat detection and security analysis.

Yara rules generatorPython

A Python tool that generates YARA rules for malware detection by filtering out strings and opcodes that appear in goodware.

MatanoRust

An open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.

Splunk Security ContentPython

An open-source repository of security detections, analytic stories, and response playbooks mapped to MITRE ATT&CK for Splunk Enterprise Security.

SELKSShell

A Linux distribution for network detection and response (NDR) built around Suricata, providing a complete NDR platform.