Public Detection Rule Repos

All in one GitHub Search:

https://github.com/search?q=T1053 (repo:elastic/detection-rules OR repo:elastic/protections-artifacts OR repo:SigmaHQ/sigma OR repo:chronicle/detection-rules OR repo:splunk/security_content OR repo:olafhartong/ThreatHunting OR repo:Azure/Azure-Sentinel OR repo:FalconForceTeam/FalconFriday OR repo:Bert-JanP/Hunting-Queries-Detection-Rules OR repo:cylaris/awesomekql OR repo:reprise99/Sentinel-Queries OR repo:rod-trent/SentinelKQL OR repo:alexverboon/MDATP OR repo:OTRF/ThreatHunter-Playbook OR repo:sublime-security/sublime-rules OR repo:ep3p/Sentinel_KQL OR repo:Cyb3r-Monk/Threat-Hunting-and-Detection OR repo:tsale/Sigma_rules OR repo:lawndoc/AdvancedHuntingQueries OR repo:panther-labs/panther-analysis OR repo:wazuh/wazuh OR repo:EightFence/Microsoft-Sentinel OR repo:The-DFIR-Report/Sigma-Rules OR repo:alexverboon/Hunting-Queries-Detection-Rules OR repo:delivr-to/detections OR repo:SentineLabs/S1QL-Queries) AND NOT (path:*.py OR path:*.ps1 OR path:*.csv OR path:*.cs OR path:*.ini)&type=code

• elastic/detection-rules
• elastic/protections-artifacts
• SigmaHQ/sigma
• chronicle/detection-rules
• splunk/security_content
• olafhartong/ThreatHunting
• Azure/Azure-Sentinel
• FalconForceTeam/FalconFriday
• Bert-JanP/Hunting-Queries-Detection-Rules
• cylaris/awesomekql
• reprise99/Sentinel-Queries
• rod-trent/SentinelKQL
• alexverboon/MDATP
• netevert/sentinel-attack
• OTRF/ThreatHunter-Playbook
• sublime-security/sublime-rules
• ep3p/Sentinel_KQL
• Cyb3r-Monk/Threat-Hunting-and-Detection
• tsale/Sigma_rules
• lawndoc/AdvancedHuntingQueries
• panther-labs/panther-analysis
• wazuh/wazuh
• EightFence/Microsoft-Sentinel
• The-DFIR-Report/Sigma-Rules
• alexverboon/Hunting-Queries-Detection-Rules
• delivr-to/detections
• SentineLabs/S1QL-Queries

Relevant Note(s): Public Attack Simulation Repos