Advanced Wazuh Detection Rules

The SOCFortress Team has commited to contributing to the Open Source community. We hope you find these rulesets helpful and robust as you work to keep your networks secure 😅

Advanced Wazuh Detection Rules

Have Wazuh deployed and ingesting your logs but looking for some better detection rules? Look no further. The objective for this repo is to provide the Wazuh community with rulesets that are more accurate, descriptive, and enriched from various sources and integrations.
Worlds First Open Source Cloud SOC »

Wazuh Docs · FREE FOR LIFE TIER · Our Blog

Table of Contents

1. About This Repo
   • Supported Rules and Integrations
2. Getting Started
   • Prerequisites
   • Installation
3. Usage
4. Roadmap
5. Contributing
6. License
7. Contact
8. Acknowledgments

About This Repo

The objective for this repo is to provide the Wazuh community with rulesets that are more accurate, descriptive, and enriched from various sources and integrations.

Here's why:

• Detection rules can be a tricky business and we believe everyone should have access to a strong and growing ruleset.
• Wazuh serves as a great EDR agent, however the default rulesets are rather laxed (in our opinion). We wanted to start building a strong repo of Wazuh rules for the community to implement themselves and expand upon as new threats arise.
• Cybersecurity is hard enough, let's work together 😄

(back to top)

Supported Rules and Integrations

Below are the current rules and integrations currently contained within this repo. Integrations, such as Office365, Sophos, etc. will have scripts provided within their respective folders for use. Feel free to build upon these scripts and contribute back 😄

• Sysmon for Windows
• Sysmon for Linux
• Office365
• Microsoft Defender
• Sophos
• MISP
• Osquery
• Yara
• Suricata
• Packetbeat
• Falco
• Modsecurity
• F-Secure
• Domain Stats
• Snyk
• Autoruns
• Sigcheck
• Powershell

(back to top)

Have Wazuh deployed and ingesting your logs but looking for some better detection rules? Look no further. The objective for this repo is to provide the Wazuh community with rulesets that are more accurate, descriptive, and enriched from various sources and integrations.

FEEL FREE TO MERGE REQUEST ANY RULES THAT YOU THINK THE COMMUNITY COULD BENEFIT FROM

Categories of various tools that this repo containes rules for are below

• Sysmon for Windows
• Sysmon for Linux
• Office365
• Microsoft Defender
• Sophos
• MISP
• Osquery
• Yara
• Suricata
• Packetbeat
• Falco
• Modsecurity
• F-Secure
• Domain Stats
• Snyk
• Autoruns
• Sigcheck
• Powershell