常见的攻击行为监测特征及方法，涵盖端点和流量，未包含PowerShell和Sysmon。预祝运营生活愉快！

extract ja3(s) when sniffing or from a pcap.

A collection of tools and detections for the Sliver C2 Frameworj

Utilities for Sysmon

Security ML models encoded as Yara rules

Import specific data sources into the Sigma generic and open signature format.

A guide on how to write fast and memory friendly YARA rules

top cyber security conferences

A Yara rule generator for finding related samples and hunting

yarGen is a generator for YARA rules

A curated list of awesome YARA rules, tools, and people.

CloudWalker Platform

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

Detect Tactics, Techniques & Combat Threats

Utilities for MITRE™ ATT&CK

An information security preparedness tool to do adversarial simulation.

Threat Report ATT&CK™ Mapping (TRAM) is a tool to aid analyst in mapping finished reports to ATT&CK.

TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.

View ETW Provider manifest

Actionable analytics designed to combat threats

Automate the creation of a lab environment complete with security tooling and logging best practices

Automated Adversary Emulation Platform

Yara Rules for Modern Malware

一款火绒增强HIPS自定义规则