GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → OTRF → Threathunter Playbook

OTRF / Threathunter Playbook

Licence: gpl-3.0
A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

Programming Languages

python
139335 projects - #7 most used programming language
YARA
70 projects
Dockerfile
14818 projects

Labels

dfirthreat-huntingsysmonhuntinghuntermitrehypothesishunting-campaignsmitre-attack-db

Projects that are alternatives of or similar to Threathunter Playbook

ir scripts
incident response scripts
Stars: ✭ 17 (-99.41%)
Mutual labels:  dfir, sysmon, threat-hunting
TA-Sysmon-deploy
Deploy and maintain Symon through the Splunk Deployment Sever
Stars: ✭ 31 (-98.92%)
Mutual labels:  dfir, sysmon, threat-hunting
Whids
Open Source EDR for Windows
Stars: ✭ 188 (-93.47%)
Mutual labels:  dfir, threat-hunting, sysmon
Sysmon Modular
A repository of sysmon configuration modules
Stars: ✭ 1,229 (-57.31%)
Mutual labels:  dfir, threat-hunting, sysmon
Sentinel Attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
Stars: ✭ 676 (-76.52%)
Mutual labels:  threat-hunting, sysmon
Threatingestor
Extract and aggregate threat intelligence.
Stars: ✭ 439 (-84.75%)
Mutual labels:  dfir, threat-hunting
Sysmontools
Utilities for Sysmon
Stars: ✭ 903 (-68.63%)
Mutual labels:  threat-hunting, sysmon
Signature Base
Signature base for my scanner tools
Stars: ✭ 1,212 (-57.9%)
Mutual labels:  dfir, threat-hunting
Sysmon Config
Sysmon configuration file template with default high-quality event tracing
Stars: ✭ 3,287 (+14.17%)
Mutual labels:  threat-hunting, sysmon
Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Stars: ✭ 976 (-66.1%)
Mutual labels:  dfir, threat-hunting
Slides
Misc Threat Hunting Resources
Stars: ✭ 203 (-92.95%)
Mutual labels:  dfir, threat-hunting
Security Onion
Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
Stars: ✭ 2,956 (+2.67%)
Mutual labels:  dfir, hunting
Threathunt
ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
Stars: ✭ 92 (-96.8%)
Mutual labels:  dfir, threat-hunting
Threathunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
Stars: ✭ 738 (-74.37%)
Mutual labels:  dfir, threat-hunting
Detectionlabelk
DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
Stars: ✭ 273 (-90.52%)
Mutual labels:  dfir, threat-hunting
Yeti
Your Everyday Threat Intelligence
Stars: ✭ 1,037 (-63.98%)
Mutual labels:  dfir, threat-hunting
Evtx Attack Samples
Windows Events Attack Samples
Stars: ✭ 1,243 (-56.83%)
Mutual labels:  dfir, threat-hunting
Malwless
Test Blue Team detections without running any attack.
Stars: ✭ 215 (-92.53%)
Mutual labels:  dfir, sysmon
Helk
The Hunting ELK
Stars: ✭ 3,097 (+7.57%)
Mutual labels:  threat-hunting, hunting
Attackdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
Stars: ✭ 264 (-90.83%)
Mutual labels:  dfir, threat-hunting
View All Similar Projects ➔

The ThreatHunter-Playbook

Binder License: GPL v3 Twitter Open Source Love

The Threat Hunter Playbook is a community-based open source project developed to share threat hunting concepts and aid the development of techniques and hypothesis for hunting campaigns by leveraging security event logs from diverse operating systems. This project provides not only information about detections, but also other very important activites when developing analytics such as data documentation, data modeling and even data quality assessments.

In addition, the analytics shared in this project represent specific chains of events exclusively at the host and network level and in a SQL-like format so that you can take them and apply the logic in your preferred tool or query format. The analytics provided in this repo also follow the structure of MITRE ATT&CK categorizing post-compromise adversary behavior in tactical groups.

Finally, the project documents detection strategies in the form of interactive notebooks to provide an easy and flexible way to visualize the expected output and be able to run the analytics against pre-recorded mordor datasets through BinderHub cloud computing environments.

Goals

  • Expedite the development of techniques an hypothesis for hunting campaigns.
  • Help Threat Hunters understand patterns of behavior observed during post-exploitation.
  • Reduce the number of false positives while hunting by providing more context around suspicious events.
  • Share real-time analytics validation examples through cloud computing environments for free.
  • Distribute Threat Hunting concepts and processes around the world for free.
  • Map pre-recorded datasets to adversarial techniques.
  • Accelerate infosec lerning through open source resources.

A Jupyter Book

I converted the whole repo into a book for you to read and follow as part of the documentation

Author

Roberto Rodriguez @Cyb3rWard0g

Official Committers

  • Jose Luis Rodriguez @Cyb3rPandaH is adding his expertise in data science to it.

Contributing

Can't wait to see other hunters' pull requests with awesome ideas to detect advanced patterns of behavior. The more chains of events you contribute the better this playbook will be for the community.

  • Submit Pull requests following the TEMPLATE format.
  • Highly recommend to test your chains of events or provide references to back it up before submitting a pull request (Article, whitepaper, hunter notes, etc).
    • Hunter notes are very useful and can help explaining why you would hunt for specific chains of events.
  • Feel free to submit pull requests to enhance hunting techniques. #SharingIsCaring

To-Do

  • OSX & Linux Playbooks
  • Cloud AWS Playbooks
  • Update Binder Libraries (Testing)
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].