Awesome-Threat-Detection

https://github.com/R0B1NL1N/Awesome-Threat-Detection

Last synced: 6 days ago
JSON representation

Threat Detection and Hunting
- Tools
  - MITRE ATT&CK Navigator - navigator)) - The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel.
  - HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
  - osquery-configuration - A repository for using osquery for incident detection and response.
  - Sysmon-DFIR - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
  - sysmon-config - Sysmon configuration file template with default high-quality event tracing.
  - RedHunt-OS - A Virtual Machine for Adversary Emulation and Threat Hunting. RedHunt aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment.
  - Oriana - Lateral movement and threat hunting tool for Windows environments built on Django comes Docker ready.
  - Bro-Osquery - Bro integration with osquery
  - Brosquery - A module for osquery to load Bro logs into tables
  - sysmon-modular - A repository of sysmon configuration modules. It also includes a [mapping](https://github.com/olafhartong/sysmon-modular/blob/master/attack_matrix/README.md) of Sysmon configurations to MITRE ATT&CK techniques.
  - Revoke-Obfuscation - PowerShell Obfuscation Detection Framework.
  - Invoke-ATTACKAPI - A PowerShell script to interact with the MITRE ATT&CK Framework via its own API.
  - Flare - An analytical framework for network traffic and behavioral analytics.
  - DeepBlueCLI - A PowerShell Module for Hunt Teaming via Windows Event Logs
  - Dispatch - An open-source crisis management orchestration framework
  - EQL - Event Query Language
  - Security Onion - An open-source Linux distribution for threat hunting, security monitoring, and log management. It includes ELK, Snort, Suricata, Zeek, Wazuh, Sguil, and many other security tools
  - Varna - A quick & cheap AWS CloudTrail Monitoring with Event Query Language (EQL)
  - EQLLib - The Event Query Language Analytics Library (eqllib) is a library of event based analytics, written in EQL to detect adversary behaviors identified in MITRE ATT&CK™.
  - BZAR - based Analytics and Reporting) - A set of Zeek scripts to detect ATT&CK techniques
  - BinaryAlert - Serverless, real-time & retroactive malware detection
  - FATT - A pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
  - FingerprinTLS - A TLS fingerprinting method
  - hollows_hunter - Scans all running processes, recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
  - ThreatHunting - A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
  - Mercury - Network fingerprinting and packet metadata capture
  - YARA - The pattern matching swiss knife
  - ElastAlert - A framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch
  - StreamAlert - A serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define
  - Kolide Fleet - A flexible control server for osquery fleets
  - Zeek Agent - An endpoint monitoring agent that provides host activity to Zeek
  - Velociraptor - Endpoint visibility and collection tool
  - Sysdig - A tool for deep Linux system visibility, with native support for containers. Think about sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce
  - go-audit - An alternative to the Linux auditd daemon
  - WAZUH - An open-source security platform
  - Zeek - A network security monitoring tool
  - ntopng - A web-based network traffic monitoring tool
  - Joy - A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring
  - Netcap - A framework for secure and scalable network traffic analysis
  - Stenographer - A full-packet-capture tool
  - JA3 - A method for profiling SSL/TLS Clients and Servers
  - HASSH - Profiling Method for SSH Clients and Servers
  - GQUIC Protocol Analyzer for Zeek
  - Recog - A framework for identifying products, services, operating systems, and hardware by matching fingerprints against data returned from various network probes
  - Sigma - Generic Signature Format for SIEM Systems
  - Sentinel Attack - A repository of Azure Sentinel alerts and hunting queries leveraging sysmon and the MITRE ATT&CK framework
  - Moloch - A large scale and open source full packet capture and search tool
  - Suricata - A network threat detection engine
  - Brim - A desktop application to efficiently search large packet captures and Zeek logs
  - RDFP - Zeek Remote desktop fingerprinting script based on [FATT](https://github.com/0x4D31/fatt) (Fingerprint All The Things)
  - Unfetter - A reference implementation provides a framework for collecting events (process creation, network connections, Window Event Logs, etc.) from a client machine and performing CAR analytics to detect potential adversary activity.
  - CimSweep - A suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows
- Resources
  - Alerting and Detection Strategy Framework
  - Expert Investigation Guide - Threat Hunting
  - Active Directory Threat Hunting
  - Windows Commands Abused by Attackers
  - Slides
  - Threat Hunting Techniques - AV, Proxy, DNS and HTTP Logs
  - Detecting Malware Beacons Using Splunk
  - Data Science Hunting Funnel
  - Use Python & Pandas to Create a D3 Force Directed Network Diagram
  - Catching attackers with go-audit and a logging pipeline
  - The Coventry Conundrum of Threat Intelligence
  - Bro-Osquery - Large-Scale Host and Network Monitoring Using Open-Source Software
  - Threat Hunting with Jupyter Notebooks
  - How Dropbox Security builds tools for threat detection and incident response
  - Introducing Event Query Language
  - The No Hassle Guide to Event Query Language (EQL) for Threat Hunting - EQLforThreatHunting.pdf))
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - The PARIS Model - A model for threat hunting.
  - NIST Cybersecurity Framework
  - Hunting the Known Unknowns (with DNS)
  - Tracking Newly Registered Domains
  - Proactive Malicious Domain Search
  - DNS is NOT Boring - Using DNS to Expose and Thwart Attacks
  - Actionable Detects - Blue Team Tactics
  - How to Hunt Command & Control Channels Using Bro IDS and RITA
  - Detect Beaconing with Flare, Elastic Stack, and Intrusion Detection Systems
  - osquery Across the Enterprise
  - osquery for Security — Part 1
  - osquery for Security — Part 2 - Advanced osquery functionality, File integrity monitoring, process auditing, and more.
  - Tracking a stolen code-signing certificate with osquery
  - The osquery Extensions Skunkworks Project
  - Threat Hunting via Windows Event Logs
  - Windows Commands Abused by Attackers
  - JPCERT - Detecting Lateral Movement through Tracking Event Logs
  - Threat Hunting with Sysmon: Word Document with Macro
  - Part I (Event ID 7)
  - Part II (Event ID 10)
  - The Sysmon and Threat Hunting Mimikatz wiki for the blue team
  - Paper - 17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science.pdf))
  - Hunting the Known Unknowns (With PowerShell)
  - Hunting for PowerShell Using Heatmaps
  - HASSH @BSides Canberra 2019 - Slides
  - RDP Fingerprinting - Profiling RDP Clients with JA3 and RDFP
  - Effective TLS Fingerprinting Beyond JA3
  - TLS Fingerprinting in the Real World
  - TLS fingerprinting - Smarter Defending & Stealthier Attacking
  - JA3er - a DB of JA3 fingerprints
  - An Introduction to HTTP fingerprinting
  - TLS Fingerprints
  - The use of TLS in Censorship Circumvention
  - On Botnets that use DNS for Command and Control
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Markov Chain Fingerprinting to Classify Encrypted Traffic
  - HeadPrint: Detecting Anomalous Communications through Header-based Application Fingerprinting
  - The ThreatHunting Project - A great [collection of hunts](https://github.com/ThreatHuntingProject/ThreatHunting/tree/master/hunts) and threat hunting resources.
  - CyberThreatHunting - A collection of resources for threat hunters.
  - Hunt-Detect-Prevent - Lists of sources and utilities to hunt, detect and prevent evildoers.
  - Alerting and Detection Strategy Framework
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Deception-as-Detection - Deception based detection techniques mapped to the MITRE’s ATT&CK framework.
  - Malware Persistence - Collection of various information focused on malware persistence: detection (techniques), response, pitfalls and the log collection (tools).
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Awesome YARA - A curated list of awesome YARA rules, tools, and resources
  - Alerting and Detection Strategies Framework - A framework for developing alerting and detection strategies.
  - Windows Hunting - A collection of Windows hunting queries
  - Tool Analysis Result Sheet
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Signal the ATT&CK: Part 1 - Building a real-time threat detection capability with Tanium that focuses on documented adversarial techniques.
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Random Words on Entropy and DNS
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - osquery Across the Enterprise
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting for Fileless Malware
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - osquery Across the Enterprise
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - osquery Across the Enterprise
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Alerting and Detection Strategy Framework
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - The PARIS Model - A model for threat hunting.
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - osquery Across the Enterprise
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Detecting dynamic DNS domains in Splunk
  - Alerting and Detection Strategy Framework
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Detection Spectrum - DetectionSpectrum.pdf))
  - Capability Abstraction - CapabilityAbstraction.pdf))
  - Threat Hunting with Jupyter Notebooks
  - Introducing the Funnel of Fidelity - IntroducingtheFunnelofFidelity.pdf))
- Videos
- Trainings
  - eLearnSecurity THP - Threat Hunting Professional
- Twitter
  - "Awesome Detection" Twitter List - Security guys who tweet about threat detection, hunting, DFIR, and red teaming
- Dataset
  - Boss of the SOC (BOTS) Dataset Version 1
  - Boss of the SOC (BOTS) Dataset Version 2
  - Boss of the SOC (BOTS) Dataset Version 3
  - theZoo - A repository of LIVE malwares
  - Mordor - Pre-recorded security events generated by simulated adversarial techniques in the form of JavaScript Object Notation (JSON) files. The data is categorized by platforms, adversary groups, tactics and techniques defined by the Mitre ATT&CK Framework.
  - EMBER - The EMBER dataset is a collection of features from PE files that serve as a benchmark dataset for researchers
Threat Simulation
- Resources

Programming Languages

Python 14 PowerShell 6 C++ 6 Go 4 C 4 Zeek 3 Jupyter Notebook 2 TypeScript 1 HTML 1 Ruby 1

Categories

Threat Detection and Hunting 515 Threat Simulation 63 License 1

Sub Categories

Resources 497 Tools 52 Videos 22 Dataset 6 Twitter 1 Trainings 1

Keywords

security 10 threat-hunting 10 dfir 6 malware-detection 5 incident-response 5 fingerprinting 4 network 4 malware-analysis 4 yara 3 nsm 3 cybersecurity 3 monitoring 3 sysmon 3 detection 3 threat-intelligence 2 powershell 2 malware-research 2 malware 2 hunting 2 rdp 2 python 2 honeypot 2 elasticsearch 2 aws 2 lambda 2 infosec 2 serverless 2 terraform 2 docker 2 security-tools 2 octo-correct-managed 2 mitre-attack 2 osquery 2 analysis 2 packet-capture 1 network-security 1 macadmin 1 packet-capture-and-analysis 1 linux 1 host-instrumentation 1 splunk 1 metadata 1 pe-sieve 1 memory-forensics 1 quic 1 kinesis 1 rules 1 anti-malware 1 ssh 1 tls 1