Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Elemental - An ATT&CK Threat Library

Mapping of open-source detection rules and atomic tests.

IOK (Indicator Of Kit) is an open source language and ruleset for detecting phishing threat actor tools and tactics

Resources To Learn And Understand SIGMA Rules

BlackBerry Threat Research & Intelligence

A pySigma wrapper and langchain toolkit for automatic rule creation/translation

S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator

Sigma detection rules for hunting with the threathunting-keywords project

Open source HIDS tailored for Microsoft Windows and Active Directory

Framework definitions that allow to build a custom SIEM.

Complete Claude skills toolkit for professional malware analysis. 5 specialized skills covering triage, dynamic analysis, detection engineering, and reporting. Works with REMnux/FlareVM offline environments.

SysFlow edge processing pipeline

Convert Sigma Rules to different formats

⚠️ ARCHIVED**: This repository is no longer actively maintained. All Sigma rules are now managed and available in SIEM Rules

Repository of Sigma Rules

Scripts played by GitHub Actions that converts Sigma rules to SentinelOne PowerQuery via PySigma.

AI-driven automated threat analysis pipeline that routes files, URLs, IPs, domains, or images through specialized security analyzers and generates professional PWNDoc reports with integrated YARA and Sigma rule.

🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and auto-generate defense rules (YARA/SIGMA). DFIR & Malware Analysis Framework.