detection-engineering

Windows Events Attack Samples

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Splunk Security Content

Misc Threat Hunting Resources

attack2jira automates the process of standing up a Jira environment that can be used to track and measure ATT&CK coverage

SIEGMA - Transform Sigma rules into SIEM consumables

Resources To Learn And Understand SIGMA Rules

Automatic detection engineering technical state compliance

A list of useful Detection Engineering-related resources.

A Go implementation and parser for Sigma rules.

Microsoft 365 Advanced Hunting queries written in Kusto Query Language (KQL)

Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques

An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.

Technical resources and knowledge base for dtection.io

A Python CLI utility for quickly converting a list or text file of MITRE ATT&CK technique IDs to a MITRE ATT&CK Navigator layer .JSON file.

Capture all events across all logs produced during the running of a particular exploit/script. Search and filter events