arkime

Arkime Arkime is a large scale, open-source network analysis and packet capture system. Arkime augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive and simple web interface is provided for PCAP...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

SOC-Analyst-Portfolio

🛡️ Allen Ace SOC Analyst | Threat Hunter | Detection Engineer Detect • Investigate • Respond • Defend Welcome This portfolio documents my hands-on cybersecurity journey through practical investigations, enterprise lab environments, detection engineering, digital forensics, malware analysis, threat...

Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 Análisis de Vulnerabilidad de MOVEit Transfer Resumen del Proyecto Este repositorio contiene un análisis técnico académico de CVE-2023-34362, una vulnerabilidad crítica de inyección SQL que afecta a MOVEit Transfer. El proyecto fue preparado para CYB625 – Hacking Ético y Pruebas de...

wazuh-home-soc

Home SOC: Threat Detection Lab with Wazuh + Suricata A self-hosted Security Operations Center lab built to detect real attack techniques against a deliberately vulnerable target, using Wazuh as the SIEM and Suricata as a network-based IDS sensor. Built to demonstrate detection engineering skills ...

MSMQ-Vulnerability

MSMQ Security Lab This repository documents a controlled lab review of Microsoft Message Queuing security exposure, focusing on defensive validation, detection evidence, and remediation planning. The project is positioned as a portfolio artefact: it shows how vulnerability research can be...

purple-team-exercise-framework

Purple Team Exercise Framework PTEF The Purple Team Exercise Framework PTEF is the industry standard methodology for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence CTI, Red Teams, and Blue Teams. Purple Team Exercises are an efficient method...

awesome-soc

Awesome SOC An operational handbook and knowledge base to build, run and mature a SOC including CSIRT. Covering: SOC basics detection engineering threat intelligence SOC metrics/KPI SOC automation AI use cases and best practices SOP SOC playbooks Those are my view, based on my own experience as...

2022

100 Days of YARA Parte 2 - Electric Detectaloo Chiedo scusa in anticipo per il nome terribile, ma benvenuti a 100 Days of YARA! Questo repository fungerà da archivio per tutte le idee YARA create durante questo periodo. Qualsiasi script, strumento o regola divertente che scrivi può essere commita...

My-Sigma-Rule-Collection

Raccolta di regole Sigma create da me a partire da ricerche che ho trovato interessanti Panoramica Questo repository contiene una raccolta di regole Sigma personalizzate che ho creato/trovato basandomi su vulnerabilità, report di minacce e tecniche che ho trovato interessanti. Ogni regola include...

Analysis

Notas e Análise de Engenharia de Detecção Este repositório documenta pesquisa prática de detecção baseada em testes de laboratório, análise de logs e fluxos de trabalho reais de SOC. O foco está em como as técnicas de ataque realmente aparecem nos logs, qual lógica de detecção funciona na prática...

deadair

Salute delle rilevazioni SIEM open-source. Trova le rilevazioni abilitate che sono cieche perché la loro telemetria è mancante, obsoleta, in ritardo o incompatibile con lo schema. Viene eseguito localmente · Sola lettura · Nessun agente · Nessun caricamento di telemetria Leggi il documento tecnic...

ThreatHunting-JupyterNotebooks

🟣 Weekly Purple Team - Notebook di Threat Hunting Una raccolta di notebook Jupyter per il threat hunting e l'ingegneria delle rilevazioni, a supporto del canale YouTube Weekly Purple Team. Ogni notebook fornisce logiche di rilevazione per aiutare i professionisti della sicurezza a comprendere sia...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Инженерная разработка обнаружений в работающей среде Microsoft Sentinel и Defender XDR, которой я управляю. Девять пользовательских аналитических правил охватывают три плоскости, каждое сопоставлено с MITRE ATT&CK и проверено от начала до конца: контролируемое...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Pipeline a impatto zero che trasforma le CVE appena armamentizzate dal catalogo CISA Known Exploited Vulnerabilities KEV in regole di rilevamento Sigma pronte per la produzione, automaticamente, ogni settimana. Il problema Convertire manualmente una nuova voce K...

SysmonCommunityGuide

Guida Community Sysmon di TrustedSec Quest'opera è distribuita con licenza Creative Commons Attribuzione-Condividi allo stesso modo 4.0 Internazionale, si prega di attribuire a TrustedSec LLC Tu sei libero di: Condividere — copiare e ridistribuire il materiale con qualsiasi mezzo o formato...

Adversarial-Detection-Engineering-Framework

Adversarial Detection Engineering ADE Framework Sei False Negatives voraus , indem du verstehst, wie Erkennungslogik versagt, bevor Bedrohungsakteure sie missbrauchen. Besuche die Website: https://adeframework.org/ Was ist ADE? Adversarial Detection Engineering ADE ist die Disziplin des Nachdenke...

Mobile-Drop-Device-SOC-Detection

🛡️ परियोजना फैंटम: मोबाइल "ड्रॉप डिवाइस" SOC डिटेक्शन सिमुलेशन यह परियोजना एक एंड-टू-एंड SOC प्रयोगशाला कार्यशाला का प्रदर्शन करती है जो यह दर्शाती है कि कैसे एक अनधिकृत, रूट-रहित एंड्रॉइड डिवाइस Casper Via S, जिसे आंतरिक नेटवर्क के भीतर "ड्रॉप डिवाइस" के रूप में उपयोग किया जाता है, Wazuh SIEM...

Accelerating detection engineering using AI-assisted synthetic attack logs generation

In this article 1. Core Idea: From TTPs to Logs 2. Approaches for Synthetic Attack Log Generation 3. Evaluation Datasets 4. References 5. Learn more Logs and telemetry are the foundation of modern cybersecurity. They enable threat detection, incident response, forensic investigation, and complian...

Accelerating detection engineering using AI-assisted synthetic attack logs generation

In this article 1. Core Idea: From TTPs to Logs 2. Approaches for Synthetic Attack Log Generation 3. Evaluation Datasets 4. References 5. Learn more Logs and telemetry are the foundation of modern cybersecurity. They enable threat detection, incident response, forensic investigation, and complian...