Sam0x90 / CB-Threat-Hunting
CarbonBlack EDR detection rules and response actions
☆70Updated last week
Related projects: ⓘ
- Repo containing various intel-based resources such as threat research, adversary emulation/simulation plan and so on☆81Updated 4 months ago
- Harness the power of Splunk for your investigations☆66Updated last month
- Sigma rules to share with the community☆113Updated last month
- A repository to share publicly available Velociraptor detection content☆115Updated this week
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆74Updated 3 weeks ago
- The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders und…☆108Updated 5 months ago
- Active C&C Detector☆148Updated 11 months ago
- Slides of my public talks☆46Updated 9 months ago
- M365/Azure adversary simulation tool designed to simulate adversary techniques and generate attack telemetry.☆110Updated 4 months ago
- User Feedback Space of #MitreAssistant☆37Updated last year
- This repo is where I store my Threat Hunting ideas/content☆85Updated last year
- Adversarial Interception Mission Oriented Discovery and Disruption Framework, or AIMOD2, is a structured threat hunting approach to proac…☆84Updated last year
- Contains compiled binaries of Volatility☆28Updated 2 months ago
- A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.☆147Updated 3 months ago
- This project aims to bridge the gap between Microsoft Attack Surface Reduction (ASR) rules and MITRE ATT&CK by mapping ASR rules to their…☆23Updated 2 weeks ago
- The ultimate solution for remotely deploying Crowdstrike sensors quickly and discreetly on any other EDR platform.☆21Updated 3 weeks ago
- MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity☆85Updated 3 years ago
- Test case indexes☆35Updated 2 months ago
- Config files for my GitHub profile.☆15Updated last year
- A pySigma wrapper and langchain toolkit for automatic rule creation/translation☆65Updated last month
- Parses USB connection artifacts from offline Registry hives☆50Updated last week
- Hunting Queries for Defender ATP☆70Updated last week
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆94Updated last year
- This guide describes a process for developing Cyber Threat Intelligence Priority Intelligence Requirements☆113Updated 9 months ago
- A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation☆75Updated 3 months ago
- A collection of various SIEM rules relating to malware family groups.☆60Updated 3 months ago
- Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise☆55Updated 4 months ago
- A specification and style guide for YARA rules☆34Updated 7 months ago
- IOC Collection 2022☆55Updated last year
- ATT&CK Powered Suit is a browser extension that puts the complete MITRE ATT&CK® knowledge base at your fingertips with text search, conte…☆69Updated this week