Sigma Rules Collection

◆

◆

◆

◆

🔮Psychic

★★

“A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs”

◆

◆

◆

◆

🔥Flame

★

“Elemental - An ATT&CK Threat Library”

◆

◆

◆

◆

💎Aqua

★

“Open detection standard -- like Sigma, but for AI agents. 425 rules, shipped in Microsoft AGT, Cisco AI Defense, MISP, OWASP A-S-R-H. 97.1% recall on NVIDIA garak. NIST OSCAL Path 1.”

◆

◆

◆

◆

🔮Psychic

★

“Mapping of open-source detection rules and atomic tests.”

◆

◆

◆

◆

🌊Water

★

“IOK (Indicator Of Kit) is an open source language and ruleset for detecting phishing threat actor tools and tactics”

◆

◆

◆

◆

📦Normal

★

“Resources To Learn And Understand SIGMA Rules”

◆

◆

◆

◆

⚙️Steel

★

“Local safety layer for AI agents that use the terminal. Screens risky commands and MCP/tool calls, watches Linux activity with eBPF, blocks dangerous behavior, and keeps audit trails local. Open source, self-hosted, dry-run by default.”

◆

◆

◆

◆

📦Normal

★

“BlackBerry Threat Research & Intelligence”

◆

◆

◆

◆

🔮Psychic

★

“A pySigma wrapper and langchain toolkit for automatic rule creation/translation”

◆

◆

◆

◆

🔮Psychic

★

“S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator”

◆

◆

◆

◆

🔮Psychic

★

“Effort to list and aggregate known malicious Google Chrome Extension IDs”

◆

◆

◆

◆

🔮Psychic

★

“Sigma detection rules for hunting with the threathunting-keywords project”