Awesome Threat Detection and Hunting

A curated list of awesome threat detection and hunting resources

Contents

• Threat Detection and Hunting
  • Tools
  • Frameworks
  • Resources
  • Videos
  • Trainings
• Contribute
• License

Tools

• HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
• osquery - An operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. It exposes an operating system as a high-performance relational database.
• osquery-configuration - A repository for using osquery for incident detection and response.
• DetectionLab - Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices.
• Sysmon-DFIR - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
• sysmon-config - Sysmon configuration file template with default high-quality event tracing
• Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

Frameworks

• MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target.
• MITRE CAR - The Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) adversary model.
• Alerting and Detection Strategies Framework - A framework for developing alerting and detection strategies.
• A Simple Hunting Maturity Model
• A Framework for Cyber Threat Hunting
• The PARIS Model

Resources

• Huntpedia - Your Threat Hunting Knowledge Compendium
• Hunt Evil - Your Practical Guide to Threat Hunting
• ThreatHunter-Playbook - A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
• The ThreatHunting Project - An informational repo about hunting for adversaries in your IT environment including a great collection of hunts.
• CyberThreatHunting - A collection of resources for Threat Hunters.
• Common Threat Hunting Techniques & Datasets
• Generating Hypotheses for Successful Threat Hunting
• Expert Investigation Guide - Threat Hunting
• sqrrl Hunting Blog
• DFIR and Threat Hunting Blog
• CyberWardog Blog

Videos

• SANS Threat Hunting and IR Summit 2017
• SANS Threat Hunting and IR Summit 2016
• BotConf 2016 - Advanced Incident Detection and Threat Hunting using Sysmon and Splunk
• BSidesCharm 2017 - Detecting the Elusive - Active Directory Threat Hunting.
• BSidesAugusta 2017 - Machine Learning Fueled Cyber Threat Hunting
• Toppling the Stack: Outlier Detection for Threat Hunters by David Bianco
• BSidesPhilly 2017 - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles
• Black Hat 2017 - Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
• DefCon 25 - MS Just Gave the Blue Team Tactical Nukes
• BSides London 2017 - Hunt or be Hunted
• SecurityOnion 2017 - Pivoting Effectively to Catch More Bad Guys
• SkyDogCon 2016 - Hunting: Defense Against The Dark Arts
• BSidesAugusta 2017 - Don't Google 'PowerShell Hunting'
• BSidesAugusta 2017 - Hunting Adversaries w Investigation Playbooks & OpenCNA

Trainings

• Threat Hunting Academy
• SANS FOR508 - Advanced Digital Forensics, Incident Response, and Threat Hunting.
• eLearnSecurity THP - Threat Hunting Professional

Contribute

Contributions welcome! Read the contribution guidelines first.

License

To the extent possible under law, Adel "0x4D31" Karimi has waived all copyright and related or neighboring rights to this work.