✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

Proactive, Open source API security → API discovery, Testing in CI/CD, Test Library with 150+ Tests, Add custom tests, Sensitive data exposure

Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.

Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

Threat-hunting tool for Linux

A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud

Threatest is a CLI and Go framework for end-to-end testing threat detection rules.

pretrained BERT model for cyber security text, learned CyberSecurity Knowledge

Crawlector is a threat hunting framework designed for scanning websites for malicious objects.

A toolkit for Security Researchers

Bypass 403

ThreatSeeker: Threat Hunting via Windows Event Logs

SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.

Threat intelligence and threat detection indicators (IOC, IOA)

Threat Detection & Anomaly Detection rules for popular open-source components