defender-for-endpoint 开源项目推荐（100 个）

Bert-JanP /Hunting-Queries-Detection-Rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

FalconForceTeam /FalconFriday

威胁狩猎查询与检测

Cyb3r-Monk /Threat-Hunting-and-Detection

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

alexverboon /MDATP

MDATP

msdirtbag /MDEAutomator

PowerShell-based Automation of Defender for Endpoint

lawndoc /AdvancedHuntingQueries

Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.

MHaggis /ASRGEN

ASR Configurator, Essentials and Atomic Testing

jischell-msft /RemoteManagementMonitoringTools

Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations

jkerai1 /SoftwareCertificates

Repository for Software Certs for easy software blocking across corp environments, for example, using MDE IOC

HybridBrothers /Hunting-Queries-Detection-Rules

The purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious behavior

alexverboon /IntuneCustomCompliance

Microsoft Intune Custom Compliance

13ihsan92 /Security-Blue-Team

This repository will describe the details surrounding the SIEM (wazuh) mini project, which will cover all aspects of topology design, deployment, rules, integration, and fine tune.

glueckkanja /IntuneLinuxBaseline

Security baseline for managing Linux devices with Microsoft Intune — Ubuntu autoinstall enrollment, custom compliance policies, and hardening scripts for Defender, firewall, encryption and updates.

NVISOsecurity /Detection-and-Hunting-Queries

This repository contains detection and threat hunting queries created by NVISO’s CSIRT and SOC teams.

danielpetri666 /DUDE-Manager

PowerShell + WPF GUI for managing DUDE automation (Dynamic User & Device Enumeration)

gh-andrem /DefenderXDR-AdvancedHunting-KQL

Defender XDR Advanced Hunting Queries (MDE, MDAV, Device Discovery)

jschell /RemoteManagementMonitoringTools

Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations

Visorian /PSMDE

Microsoft Defender for Endpoint PowerShell module

microsoft /python-for-security

Python for Security is the home of all open source Python projects that can integrate with Microsoft Technologies.

dferrell30 /Defender-KQL-Playbook

KQL playbook for Microsoft Defender focused on real-world threat hunting, behavioral analysis, and investigation workflows.