SigmaHQ / sigma

Main Sigma Rule Repository

crazy-max / WindowsSpyBlocker

Block spying and tracking on Windows

olafhartong / sysmon-modular

A repository of sysmon configuration modules

microsoft / Sysmon-Linux

Sysmon for Linux

wagga40 / Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Karib0u / rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.