A repository of sysmon configuration modules
-
Updated
Aug 10, 2026 - PowerShell
#
threat-hunting
Here are 92 public repositories matching this topic...
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
graylog logging forensics dfir sysmon threat-hunting siem threat-sharing threatintel netsec sysinternals graylog-plugin forensic-analysis threat-analysis threat-intelligence humio mitre-attack sigma-rules forensicartifacts digitalforensics
-
Updated
Nov 5, 2023 - PowerShell
A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
azure incident-response dfir cybersecurity threat-hunting digital-forensics threathunting cloud-forensics azure-forensics azuresearcher azforensics unifiedauditlog powershellv5
-
Updated
Oct 29, 2022 - PowerShell
Awesome list of keywords and artifacts for Threat Hunting sessions
splunk incident-response dfir awesome-list threat-hunting siem iocs offensive-security soc yara-rules elk-stack blueteam threat-intelligence redteam forensic hacktools endpoint-security threathunting offensive-scripts detection-engineering
-
Updated
Aug 4, 2025 - PowerShell
This repo is about Active Directory Advanced Threat Hunting
-
Updated
Feb 17, 2025 - PowerShell
DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
-
Updated
Dec 12, 2021 - PowerShell
Automation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
elasticsearch splunk powershell active-directory threat-hunting windows-event-logs windows-event-collector
-
Updated
Nov 21, 2024 - PowerShell
Cover various security approaches to attack techniques and also provides new discoveries about security breaches.
-
Updated
Apr 17, 2025 - PowerShell
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
-
Updated
Nov 3, 2020 - PowerShell
Microsoft Sentinel SOC Operations
microsoft security azure incident-response secops threat-hunting siem hunting soc ir cloudsecurity threat-intelligence azure-sentinel microsoft-sentinel
-
Updated
Jul 24, 2026 - PowerShell
Purpleteam scripts simulation & Detection - trigger events for SOC detections
windows linux security ioc awesome simulation detection tactics awesome-list threat-hunting siem soc techniques blueteam redteam mitre-attack purpleteam threathunting offensive-scripts detection-engineering
-
Updated
Dec 20, 2024 - PowerShell
Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
-
Updated
Dec 11, 2017 - PowerShell
Gather Open-Source Intelligence using PowerShell.
automation censys osint powershell cybersecurity infosec threat-hunting virustotal threatminer alienvault hybrid-analysis cymon crtsh greynoise malshare urlscan threatcrowd urlhaus pulsedive
-
Updated
Oct 20, 2019 - PowerShell
Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MITRE ATT&CK mapping.
sentinel threat-hunting blue-team logicapps security-operations kql detection-engineering microsoft-sentinel advanced-hunting m365-defender defender-xdr kql-threathunting kql-queries
-
Updated
Aug 19, 2026 - PowerShell
ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
-
Updated
Jul 25, 2019 - PowerShell
Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
-
Updated
Aug 15, 2025 - PowerShell
Threat Hunting with ELK Workshop (InfoSecWorld 2017)
-
Updated
Oct 31, 2017 - PowerShell
Improve this page
Add a description, image, and links to the threat-hunting topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the threat-hunting topic, visit your repo's landing page and select "manage topics."