Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 MOVEit Transfer Schwachstellenanalyse Projektübersicht Dieses Repository enthält eine akademische technische Analyse von CVE-2023-34362, einer kritischen SQL-Injection-Schwachstelle, die MOVEit Transfer betrifft. Das Projekt wurde für CYB625 – Ethical Hacking & Penetration Testing...

purple-team-exercise-framework

Purple Team Exercise Framework PTEF Das Purple Team Exercise Framework PTEF ist die branchenübliche Standardmethodik für die Planung und Durchführung kollaborativer Sicherheitsübungen, die Cyber Threat Intelligence CTI, Red Teams und Blue Teams zusammenbringen. Purple Team Exercises sind eine...

Detection-Rules

APT29-Erkennungsregeln Detection Engineering Produktionsreife Sigma-Erkennungsregeln, entwickelt aus der Analyse von 196.071 Sysmon-Ereignissen im APT29-Datensatz der MITRE ATT&CK Evaluations. Überblick Dieses Repository enthält validierte Erkennungsregeln für Angreiferverhalten, das während der...

ThreatHunting-JupyterNotebooks

🟣 Weekly Purple Team - Cadernos de Threat Hunting Uma coleção de cadernos Jupyter de threat hunting e engenharia de detecção que acompanham o canal do YouTube Weekly Purple Team. Cada caderno fornece lógica de detecção para ajudar profissionais de segurança a entender tanto técnicas ofensivas...

Analysis

Detection Engineering: Notizen und Analysen Dieses Repository dokumentiert praxisnahe Erkennungsforschung basierend auf Labortests, Loganalysen und realen SOC-Workflows. Der Fokus liegt darauf, wie Angreifertechniken tatsächlich in Logs erscheinen, welche Erkennungslogik in der Praxis funktionier...

My-Sigma-Rule-Collection

Raccolta di regole Sigma create da me a partire da ricerche che ho trovato interessanti Panoramica Questo repository contiene una raccolta di regole Sigma personalizzate che ho creato/trovato basandomi su vulnerabilità, report di minacce e tecniche che ho trovato interessanti. Ogni regola include...

SysmonCommunityGuide

TrustedSec Sysmon सामुदायिक मार्गदर्शिका यह कार्य क्रिएटिव कॉमन्स एट्रिब्यूशन-शेयरअलाइक 4.0 अंतर्राष्ट्रीय लाइसेंस के अंतर्गत लाइसेंस प्राप्त है, कृपया TrustedSec LLC को श्रेय दें आप स्वतंत्र हैं: साझा करें — सामग्री को किसी भी माध्यम या प्रारूप में प्रतिलिपि और पुनर्वितरित करें। अनुकूलित करें —...

MSMQ-Vulnerability

MSMQ-Sicherheitslabor Dieses Repository dokumentiert eine kontrollierte Laborüberprüfung der Sicherheitsrisiken von Microsoft Message Queuing, mit Schwerpunkt auf defensiver Validierung, Erkennungsnachweisen und Planung von Abhilfemaßnahmen. Das Projekt ist als Portfolio-Artefakt positioniert: Es...

Mobile-Drop-Device-SOC-Detection

🛡️ परियोजना फैंटम: मोबाइल "ड्रॉप डिवाइस" SOC डिटेक्शन सिमुलेशन यह परियोजना एक एंड-टू-एंड SOC प्रयोगशाला कार्यशाला का प्रदर्शन करती है जो यह दर्शाती है कि कैसे एक अनधिकृत, रूट-रहित एंड्रॉइड डिवाइस Casper Via S, जिसे आंतरिक नेटवर्क के भीतर "ड्रॉप डिवाइस" के रूप में उपयोग किया जाता है, Wazuh SIEM...

2022

100 Days of YARA Parte 2 - Electric Detectaloo Chiedo scusa in anticipo per il nome terribile, ma benvenuti a 100 Days of YARA! Questo repository fungerà da archivio per tutte le idee YARA create durante questo periodo. Qualsiasi script, strumento o regola divertente che scrivi può essere commita...

Adversarial-Detection-Engineering-Framework

Framework ADE Adversarial Detection Engineering Supera i Falsi Negativi comprendendo come la logica di rilevamento fallisce prima che gli attaccanti la sfruttino. Visita il sito web: https://adeframework.org/ Cos'è ADE? Adversarial Detection Engineering ADE è la disciplina del ragionamento sui...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Pipeline a impatto zero che trasforma le CVE appena armamentizzate dal catalogo CISA Known Exploited Vulnerabilities KEV in regole di rilevamento Sigma pronte per la produzione, automaticamente, ogni settimana. Il problema Convertire manualmente una nuova voce K...

SOC-Analyst-Portfolio

🛡️ Allen Ace Analista SOC | Threat Hunter | Ingegnere delle Detection Rileva • Investiga • Rispondi • Difendi Benvenuti Questo portfolio documenta il mio percorso pratico nella cybersecurity attraverso investigazioni reali, ambienti lab aziendali, detection engineering, digital forensics e securit...

deadair

Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly · Featured in tl;dr s...

wazuh-home-soc

Home SOC: Laboratorio di Rilevamento Minacce con Wazuh + Suricata Un laboratorio autogestito di Security Operations Center progettato per rilevare tecniche di attacco reali contro un target deliberatamente vulnerabile, utilizzando Wazuh come SIEM e Suricata come sensore IDS basato sulla rete...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Detection-Engineering in einer Microsoft-Sentinel- und Defender-XDR-Live-Umgebung, die ich selbst betreibe. Neun benutzerdefinierte Analytics-Regeln erstrecken sich über drei Ebenen, sind jeweils auf MITRE ATT&CK abgebildet und durchgängig nachgewiesen: eine...

awesome-linux-attack-forensics-purplelabs

awesome-linux-attack-forensics-purplelabs Questa pagina è il risultato di una ricerca pratica continua su attacchi Linux avanzati, tecniche di detection e strumenti di digital forensics. Poiché da anni pratico l'approccio red vs blue, il materiale seguente ti permetterà di vedere la portata del...

Accelerating detection engineering using AI-assisted synthetic attack logs generation

In this article 1. Core Idea: From TTPs to Logs 2. Approaches for Synthetic Attack Log Generation 3. Evaluation Datasets 4. References 5. Learn more Logs and telemetry are the foundation of modern cybersecurity. They enable threat detection, incident response, forensic investigation, and complian...

Accelerating detection engineering using AI-assisted synthetic attack logs generation

In this article 1. Core Idea: From TTPs to Logs 2. Approaches for Synthetic Attack Log Generation 3. Evaluation Datasets 4. References 5. Learn more Logs and telemetry are the foundation of modern cybersecurity. They enable threat detection, incident response, forensic investigation, and complian...

Your Cloud Detection Strategy in 2026: What to Expect at the Global Cybersecurity Summit

Cloud environments have changed how security teams detect and respond to threats. Signals come from more places, identities are harder to track, and attacks rarely stay within a single system. For many teams, the challenge is no longer visibility. It is having the risk context to understand what...