sysmon 开源项目推荐（877 个）

SigmaHQ /sigma

Sigma 主规则仓库

SwiftOnSecurity /sysmon-config

Sysmon configuration file template with default high-quality event tracing

crazy-max /WindowsSpyBlocker

Block spying and tracking on Windows

clong /DetectionLab

自动化创建一个完整的实验室环境，包括安全工具和日志最佳实践

OTRF /ThreatHunter-Playbook

一个社区驱动的开源项目，共享检测逻辑、对手间谍技术和资源，以提高检测开发的效率。

olafhartong /sysmon-modular

A repository of sysmon configuration modules

nshalabi /SysmonTools

Utilities for Sysmon

0xrawsec /whids

Open Source EDR for Windows

edoardogerosa /sentinel-attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

MHaggis /sysmon-dfir

Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

wagga40 /Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

ion-storm /sysmon-config

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.

Yamato-Security /EnableWindowsLogSettings

Documentation and scripts to properly enable Windows event logs.

RoomaSec /RmEye

戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑

Karib0u /rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

JPCERTCC /SysmonSearch

Investigate suspicious activity by visualizing Sysmon's event log

wecooperate /iMonitorSDK

The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能， 而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发

0xrajneesh /Log-Analysis-Projects-for-Beginners

Hands-on cybersecurity training projects for beginners, focusing on vulnerability management, incident response, and log analysis

n0dec /MalwLess

Test Blue Team detections without running any attack.

matterpreter /Shhmon

Silencing Sysmon via driver unload