Sysmon

Kunai

Kunai is a Linux-based system monitoring tool that provides real-time monitoring and threat hunting capabilities.

Windows EVTX Samples [200 EVTX examples]

Container of 200 Windows EVTX samples for testing detection scripts and training on DFIR.

sysmon-modular

A Sysmon configuration repository for customizing Microsoft Sysinternals Sysmon configurations with modular setup.

ThreatHunting

A Splunk app mapped to MITRE ATT&CK to guide threat hunts.

Sysmon for Linux

Sysmon for Linux is a tool that monitors and logs system activity with advanced filtering to identify malicious activity.

sysmon-config

A Sysmon configuration file template with detailed explanations and tutorial-like features.

Forensia

Anti-forensics tool for Red Teamers to erase footprints and test incident response capabilities.

SysmonSearch

SysmonSearch makes event log analysis more effective by aggregating Microsoft Sysmon logs and providing detailed analysis through Elasticsearch and Kibana.

Sentinel ATT&CK

A threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel

Cyber Threat Hunting

A collection of tools and resources for threat hunters.