sigma by SigmaHQ

Main Sigma Rule Repository

created at Dec. 24, 2016, 9:48 a.m.

Python

325 +1

7,623 +19

2,093 +6

GitHub
volatility by volatilityfoundation

An advanced memory forensics framework

created at April 24, 2014, 3:45 p.m.

Python

308 -1

6,931 +14

1,249 +2

GitHub
caldera by mitre

Automated Adversary Emulation Platform

created at Nov. 29, 2017, 1:25 a.m.

Python

167 +0

5,180 +7

1,011 +4

GitHub
grr by google

GRR Rapid Response: remote live forensics for incident response

created at Dec. 4, 2013, 12:17 a.m.

Python

316 +0

4,650 +3

759 +0

GitHub
ThreatHunter-Playbook by OTRF

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

created at March 28, 2017, 3:07 a.m.

Python

370 +0

3,870 +7

795 +3

GitHub
capa by mandiant

The FLARE team's open-source tool to identify capabilities in executable files.

created at June 16, 2020, 9:24 p.m.

Python

78 +0

3,855 +13

491 -1

GitHub
Loki by Neo23x0

Loki - Simple IOC and YARA Scanner

created at Jan. 18, 2015, 8:39 a.m.

Python

187 +0

3,226 +7

572 +0

GitHub
streamalert by airbnb

StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

created at Jan. 22, 2017, 1:10 a.m.

Python

101 +0

2,827 -1

334 +1

GitHub
LogonTracer by JPCERTCC

Investigate malicious Windows logon by visualizing and analyzing Windows event log

created at Nov. 24, 2017, 6:07 a.m.

Python

136 +0

2,628 +0

440 +0

GitHub
timesketch by google

Collaborative forensic timeline analysis

created at June 19, 2014, 5:49 p.m.

Python

137 +1

2,489 +4

565 +1

GitHub
volatility3 by volatilityfoundation

Volatility 3.0 development

created at Jan. 26, 2014, 6:09 p.m.

Python

55 -1

2,215 +12

367 +3

GitHub
MozDef by mozilla

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

created at Feb. 18, 2014, 7:43 a.m.

Python

149 +0

2,172 -2

327 +0

GitHub
osxcollector by Yelp

A forensic evidence collection & analysis toolkit for OS X

created at Aug. 4, 2014, 6:25 p.m.

Python

125 +0

1,860 -1

240 +0

GitHub
DidierStevensSuite by DidierStevens

Please no pull requests for this repository. Thanks!

created at May 8, 2015, 11:21 a.m.

Python

122 +0

1,836 +5

500 -1

GitHub
CAPEv2 by kevoreilly

Malware Configuration And Payload Extraction

created at Oct. 15, 2019, 6:16 p.m.

Python

64 +1

1,671 +13

378 +2

GitHub
plaso by log2timeline

Super timeline all the things

created at Sept. 8, 2014, 11:29 p.m.

Python

92 +1

1,624 +6

324 +0

GitHub
viper by viper-framework

Binary analysis and management framework

created at Nov. 9, 2013, 6:24 p.m.

Python

147 +0

1,533 +0

351 +0

GitHub
APT-Hunter by ahmedkhlief

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

created at Dec. 26, 2020, 9:52 p.m.

Python

47 +0

1,147 +3

227 +0

GitHub
metta by uber-common

An information security preparedness tool to do adversarial simulation.

created at Nov. 1, 2017, 9:24 p.m.

Python

74 +0

1,074 +0

151 +0

GitHub
RTA by endgameinc

None

created at March 19, 2018, 7:59 p.m.

Python

98 +0

1,034 +3

213 +0

GitHub