#Detection-engineering
Showing 32 of 32 repositories tagged #detection-engineering, ranked by stars
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
A curated knowledge base to build, run and mature a SOC (including CSIRT).
Awesome Security lists for SOC/CERT/CTI
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Splunk Security Content
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
A resource containing all the tools each ransomware gangs uses
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
Pipelined Query Language
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.
AI EDR for developer workstations and autonomous agent fleets. Build Swarm Detection & Response platforms with Clawdstrike.
15-stage Windows malware development & analysis course in Rust. Red team builds it, blue team detects it. All 15 binaries achieved 0/76 on VirusTotal.
Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques
An index of publicly available and open-source threat detection rulesets.
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.
Digital Forensics Incident Response and Detection engineering: Análisis forense de artefactos comunes y no tan comunes. Técnicas anti-forense y detección de técnicas utilizadas por actores maliciosos para la evasión de sistemas de protección y monitorización.
A Go implementation and parser for Sigma rules.
A pySigma wrapper and langchain toolkit for automatic rule creation/translation
🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.
Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research includes a scoring model, methodology, and worked examples.
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
Living off the Land (LOL) attack techniques, tools, and defender resources
Echos is a stealthy C2 traffic emulator built in Rust for Red Teamers. It simulates adversarial beaconing patterns and custom jitter to test EDR/NDR detection logic. Ideal for validating network security signatures in a safe, modular framework.
A POC to implement Detection-as-Code with Terraform and Sumo Logic.
An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.
Portable security rules for the action boundary of AI agents
😉 Vehicle 🥶Detection 🤢 Counting 😩 Using 👿 YOLO 🤡 and 👹 Masking 🤖 is 🛸 a 🙉 computer 😿 vision 😠 project 👽 that 🚂 automatically 🚃 detects 🚋 tracks ✈ counts 🚀 vehicles 🛸 from 🚟 images 🚠 or 🚋 video 🚡streams 🛬 using 🚞 YOLO 🕌 based 🏟 object 🏩 detection 🏚 combined 🏯 with 🏤 region 🏰 masking 🚝 techniques 🚛
A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.
An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.