Skip to content

wagga40/Zircolite-Rules

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Zircolite-Rules

This repository uses Github Actions to generate periodically updated Sigma rulesets in Zircolite format.

Default rulesets

With the exceptions of the last two, these rulesets have been generated with sigmac wich is available in the official sigma repository. The rulesets with "pysigma" in their names have been generated with the news SQLite backend for pySigma.

⚠️ These rulesets are given "as is" to help new analysts to discover SIGMA and Zircolite. They are not filtered for slow rules, rules with a lot of false positives etc. If you know what you do, you SHOULD generate your own rulesets.

  • rules_windows_generic_full.json : Full SIGMA ruleset from the "Windows", "rules-emerging-threats" and "rules-threat-hunting" directories of the official repository (no SYSMON rewriting)
  • rules_windows_generic_high.json : Only level high and above SIGMA rules from the "Windows", "rules-emerging-threats" and "rules-threat-hunting" directories of the official repository (no SYSMON rewriting)
  • rules_windows_generic_medium.json : Only level medium and above SIGMA rules from the "Windows", "rules-emerging-threats" and "rules-threat-hunting" directories of the official repository (no SYSMON rewriting)
  • rules_windows_generic.json : Same file as rules_windows_generic_high.json
  • rules_windows_sysmon_full.json : Full SIGMA ruleset from the "Windows", "rules-emerging-threats" and "rules-threat-hunting" directories of the official repository (SYSMON)
  • rules_windows_sysmon_high.json : Only level high and above SIGMA rules from the "Windows", "rules-emerging-threats" and "rules-threat-hunting" directories of the official repository (SYSMON)
  • rules_windows_sysmon_medium.json : Only level medium and above SIGMA rules from the "Windows", "rules-emerging-threats" and "rules-threat-hunting" directories of the official repository (SYSMON)
  • rules_windows_sysmon.json : Same file as rules_windows_sysmon_high.json
  • rules_windows_sysmon_pysigma.json : Same file as rules_windows_sysmon_full.json but generated with pySigma
  • rules_windows_generic_pysigma : Same file as rules_windows_generic_full.json but generated with pySigma
  • rules_linux.json : Linux rules converted "as is"

About

Sigma rules converted for direct use with Zircolite

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages