detection-rules

Sigma rules, ElasticSearch hunting queries, and YARA signatures for common attacker techniques.

All rules are mapped to MITRE ATT&CK and include tuning notes and false positive guidance.

Structure

sigma/
  discovery/        # T1046, T1595, T1018
  initial-access/   # T1190, T1133
  credential-access/ # T1110, T1078
elastic-queries/    # KQL equivalents for ELK stack
yara/               # Malware and exploit artifact signatures

MITRE Coverage

Technique	Title	Status
T1046	Network Service Scanning	✅
T1110.001	Brute Force: Password Guessing	✅
T1190	Exploit Public-Facing Application	🔄 coming
T1595.002	Active Scanning: Vulnerability Scanning	🔄 coming

Usage

Rules are written in Sigma format and can be converted to any SIEM using sigmac or pySigma.

# Convert to Elastic SIEM
sigma convert -t elasticsearch sigma/discovery/T1046-network-service-scan.yml

# Convert to Splunk
sigma convert -t splunk sigma/discovery/T1046-network-service-scan.yml