sysmon-config

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

Sysmon and wazuh integration with Sigma sysmon rules [updated]

Sysmon config for both Windows and Linux Devices. Windows one is a bit dated

This script enhances endpoint logging telemetry for the purpose of advanced malware threat detection or for building detections or malware analysis. This can be used in production, however you might want to tune the GPO edits as needed.

This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.

Import and export custom Sysmon configurations using an interactive GUI that lets you build event rules, manage filters, and generate clean XML configs without manually editing Sysmon files.

Comprehensive Sysmon configuration file (sysmon_config.xml) specifically designed for integration with Wazuh SIEM. The configuration is optimized to detect and monitor security-relevant events based on MITRE ATT&CK framework techniques.

A web application dedicated to write sysmon configuration file

CeramicSkate0 Sysmon configuration fork file template with default high-quality event tracing

Detection Wizard brings YARA, Suricata, Sigma, Sysmon, QRadar, Splunk, and IOCs into one powerful interface for powerful rule management and threat detection.

Utility to convert SysInternals' Sysmon binary configuration to XML

A cutting-edge, real-time security monitoring system, designed to revolutionize your network's defense

Converts Sysmon rules to uberAgent ESA Threat Detection rules

The Granted Access Converter is a utility designed to help users understand and interpret the GrantedAccess values found in Sysmon Event ID 10 logs.

Wixsharp based installed MSI for Sysmon and rules from the SwiftOnSecurity project

Incident Response (IR) ve tehdit tespiti odaklı optimize edilmiş bir Sysmon konfigürasyonu içerir.

Home SOC Lab v2.0 — Wazuh SIEM with 10 custom MITRE ATT&CK detection rules, Atomic Red Team simulation (8/10 detected), and 3 professional incident reports.

(Sysmon) with automation tools (PowerShell) to get instant alerts (API Telegram)

Ransomware focused Sysmon configuration file template with default high-quality event tracing

Built SOC detection engineering lab: Sysmon + Splunk pipeline, 6 MITRE ATT&CK-mapped detections built with Atomic Red Team, a live dashboard, and a formal incident report.