Logging(Host/Network) / Security Monitoring / Threat Hunting

Logging
- 101
  - Logging vs Tracing vs Monitoring - Phil Winder
  - An Introduction to Logging for Programmers - Stefanos Vardalos(2017)
  - Logs Are Streams, Not Files - Adam Wiggins(2011)
  - Logs and Metrics - Cindy Sridharan(2017)
  - Logs and Time Series are not the same - Philip O'Toole(2020)
  - How To Create a Logging Strategy - Tom Harrison(2021)
  - Ultimate Guide - Loggly
    - Ultimate Guide to Logging - Your open-source resource for understanding, analyzing, and troubleshooting system logs
  - Log File Monitoring and Alerting - DHound
  - Reliable Event Logging Protocol - Wikipedia
- Articles/Writeups
  - General
  - Building
    - Building A Central Logging Service In-House - Akhil Labudubariki(2018)
    - Part 1: Building a Centralized Logging Application - Vikesh Tiwari(2018)
  - Experiences
    - Lies My Parents Told Me (About Logs) - Charity Majors(2017)
    - Transitioning Logging and Monitoring Systems at The Economist - Kathryn Jonas(2017)](https://hackernoon.com/transitioning-logging-and-monitoring-systems-at-the-economist-3c6116ba30a8)
    - When logging causes security incidents; What we learned from GitHub and Twitter - Scott Helme(2018)
  - Stream Processing
    - Logs and real-time stream processing - Jay Kreps(2016)
  - Structured Logging
    - You Could Have Invented Structured Logging - Eben Freeman(2017)
    - Structured Logging and Your Team - (2018)
  - Testing
    - Why and How to Test Logging - Manuel Pais, Matthew Skelton(2016)
- Talks/Presentations/Videos
  - Un-broken logging - the foundation of operability - Matthew Skelton(Operability.io2015)
    - Slides
    - The way in which many (most?) software teams use logging needs a re-think as we move into a world of microservices and remote sensors. Instead of using logging merely to dump out stack traces, our logs become a continuous trace of application state, with unique-enough identifiers for every interesting point of execution. We also use transaction identifiers to trace calls across components, services, and queues, so that we can reconstruct distributed calls after the fact. Logging becomes a rich source of insight for developers and operations people alike, as we 'listen to the logs' and tighten feedback cycles to improve our software systems.
  - One Puzzle Piece at a Time: Logging Quick Wins - Celeste Hall(BSides Cleveland2018)
    - Have you put off setting up log analytics in your organization? With everything else we have to do, it can be easy to let logs take the back seat. That changes today! Learn what logs to ingest and how to get started with some quick and easy log monitoring searches. Then, use it to get insight into your organization and start "putting the puzzle together."
  - Logging ALL THE THINGS Without All The Cost With Open Source Big Data Tools - DEFCON22 - Zach Fasel
    - Many struggle in their job with the decision of what events to log in battle against costly increases to their licensing of a commercial SIEM or other logging solution. Leveraging the open source solutions used for "big-data" that have been proven by many can help build a scalable, reliable, and hackable event logging and security intelligence system to address security and (cringe) compliance requirements. We’ll walk through the various components and simple steps to building your own logging environment that can extensively grow (or keep sized just right) with just additional hardware cost and show numerous examples you can implement as soon as you get back to work (or home).
  - Logging Pitfalls and How to Abuse Them - Kevin Kaminski, Michael Music(BSides Tampa2019)
    - You cannot defend from what you cannot see. A lack of proper logging from endpoints, servers, and security appliances is a widespread issue for companies in every industry. We will outline the most common logging gaps, mistakes, and misconfigurations that we've seen and how an attacker can abuse them. This can include identifying what exactly the blue team will not see, and how knowledge of the shortcomings can allow attackers to evade the blue team or generally be more lazy and comfortable in their attack. We will also offer insight on how to solve these common problems from a high level.
  - When Logging Everything Becomes an Issue - Edward Ruprecht - Edward Ruprecht(WWHF2020)
    - Discussing potential issues with logging Sysmon and PowerShell logs. Potential sensitive data leakage, best practices, and scalability issues.
Monitoring
- 101
- Articles/Blogposts/Writeups
  - General
    - The Mon-ifesto Part 1: Metrics - Peter Christian Fraedrich(2018)
    - Crown Jewels: Monitoring vs Mitigating - Pen Consultants
    - Introducing the Funnel of Fidelity - Jared Atkinson(2019)
      - [...]As a result, I created a model to describe the conceptual process that organizations follow to quantify the high level roles and responsibilities of a detection and response program. As events pass through the model the depth of event analysis and fidelity is increased. For this reason I call the model the Funnel of Fidelity (following the naming convention of David Bianco’s Pyramid of Pain).
  - Experiences
    - Monitoring of GitLab.com - Marin Jankovski, Steve Loyd
    - Lessons from Building Observability Tools at Netflix - Netflix(2018)
- Talks/Presentations/Videos
  - Taking Event Correlation With You - Rob King(BHUSA2015)
  - Effective Monitoring for Operational Security - Russell Mosley, Ryan St. Germain(BSidesCharm2018)
    - As Infosec practitioners, how well do you really know and monitor your IT and business operations? Would you identify a data exfiltration event by a bandwidth increase without attendant malware alerts? Would you identify an employee staying late and attempting to gain physical access to a restricted area? Would you identify a successful VPN login from another country? We will present effective monitoring methods we utilize and the resulting outputs that teach us what normal operations look like in order to identify suspicious activity. By reviewing these types of reports or tickets on a daily basis you will know your IT and business operations well enough to identify anomalies that may evade detection by your security tools. We will show example reports and tickets from our organization covering a variety of these topics and discuss how we analyze them, as well as how we use the information to better tune our monitoring tools.
- Breach Detection/Response
  - Articles/Blogposts/Presentations/Talks/Writeups
    - The fox is in the Henhouse - Detecting a breach before the damage is done
  - Tools
    - Infection Monkey
      - The Infection Monkey is an open source security tool for testing a data center's resiliency to perimeter breaches and internal server infection. The Monkey uses various methods to self propagate across a data center and reports success to a centralized Command and Control(C&C) server.
    - 411
      - Configure Searches to periodically run against a variety of data sources. You can define a custom pipeline of Filters to manipulate any generated Alerts and forward them to multiple Targets.
    - Pattern
      - Pattern is a web mining module for Python. It has tools for: Data Mining: web services (Google,; Twitter, Wikipedia), web crawler, HTML DOM parser; Natural Language Processing: part-of-speech taggers, n-gram search, sentiment analysis, WordNet; Machine Learning: vector space model, clustering, classification (KNN, SVM, Perceptron); Network Analysis: graph centrality and visualization.
- FileSystem
  - Tools
    - fswatch
      - A cross-platform file change monitor with multiple backends: Apple OS X File System Events, *BSD kqueue, Solaris/Illumos File Events Notification, Linux inotify, Microsoft Windows and a stat()-based backend.
- Graphing
  - Metric graphs 101: Timeseries graphs - John Matson(2016)
- Infrastructure Monitoring
  - Ninja Level Infrastructure Monitoring Workshop - Defcon24
    - This repository contains all the presentation, documentation and the configuration, sample logs, ansible playbook, customized dashboards and more.
- Infra Metrics
  - Articles/Blogposts/Writeups
    - Building low-overhead metrics collection for high-performance systems - Jonathan Brown(2018)
- Web
  - Tools
    - GoAccess
      - GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal on *nix systems or through your browser. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly.
Detection Engineering
- 101
  - Articles/Writeups
  - Talks & Presentations
    - Waking up the data engineer in you! - Jared Atkinson(Derbycon2019)
      - At almost every company we visit, we find that there is a disconnect between data engineers and security analysts. Security analysts are responsible for using available data to find potential adversaries, while data engineers are responsible for securing, standardizing, and making data available for analysts. It may seem obvious that these two roles should work together, but it is usually not the case which limits how analysts can use data and technology to detect adversaries. This talk focuses on why it is important for security analysts to understand data engineering basics before building detections. We will use a detection use case to show how a non-scalable process can be made into an efficient detection by looking at telemetry as the foundation of a strong detection capability.
    - $SignaturesAreDead = “Long Live RESILIENT Signatures” wide ascii nocase - Matthew Dunwoody, Daniel Bohannon(BruCON 0x0A)
      - Signatures are dead, or so we're told. It's true that many items that are shared as Indicators of Compromise (file names/paths/sizes/hashes and network IPs/domains) are no longer effective. These rigid indicators break at the first attempt at evasion. Creating resilient detections that stand up to evasion attempts by dedicated attackers and researchers is challenging, but is possible with the right tools, visibility and methodical (read iterative) approach. As part of FireEye's Advanced Practices Team, we are tasked with creating resilient, high-fidelity detections that run across hundreds of environments and millions of endpoints. In this talk we will share insights on our processes and approaches to detection development, including practical examples derived from real-world attacks.
    - The Unified Kill Chain: Designing a Unified Kill Chain for analyzing, comparing and defending against cyber attacks - Mr. drs. Paul Pols(2017)
      - "In this thesis,a Unified Kill Chain(UKC)modelis developedthat focuses on the tactics that form the consecutive phases of cyber attacks(Table 1). Ahybrid research approach is used to develop the UKC,combiningdesign science with qualitative research methods. The UKC is first developed through literature study, extendingthe CKC by uniting improvements that were previously proposed by other authors withthe tactics of MITRE’s ATT&CK™model. The UKC is subsequently iteratively evaluatedand improved through case studies of attacksby Fox-IT’s Red Team and APT28(alias Fancy Bear). The resulting UKC is a meta model that supports the development of end-to-end attack specific kill chains and actor specific kill chains, that can subsequently be analyzed, compared and defended against."
    - The Art of Detection - Jay Dimartino(DEFCON27 Packet Hacking Village)
      - Ever inherited a security rule you were afraid to modify? Ever import a Yara rule only to have the alerts blow up in your face? Does your SEIM or security appliance keep you up at night with email alerts? The Art of Detection focuses on the methodology of writing and sharing accurate detections to make you a better detection author. Gain confidence in managing false positives, learn rule sharing best practices, tackle large monolithic detections, and write detections that feed other detections. Learn the importance of your intelligence test data, and if your intelligence streams could be causing bias.
    - The return of detection engineering: detection development using CI/CD - Patrick Bareiß(x33fcon2020)
      - The later you find a bug in your detections, the more expensive it is to solve it! Therefore, the presenters will introduce CI pipelines in order to proactively find bugs in detection rules, before they are deployed in production. The CI pipelines leverage a combination of lab and attack simulation. Well developed detection rules provide strong signals into anomalous and potentially malicious activity. Poorly developed detection rules flood the analysts with low-level alerts and are the cause of alert fatigue. This talk will introduce a modern approach of detection engineering using Continuous Integration and Continuous Delivery (CI/CD). The later you find a bug in your detections, the more expensive it is to solve it! Therefore, the presenter will introduce CI pipelines in order to proactively find bugs in detection rules, before they are deployed in production. In order to successfully test the effectiveness of your detection, you need a lab and an attack simulation engine. The attack range combines both a lab and attack simulation into an easy to use tool. The presenter will introduce the attack range tool and show how you can integrate it into your CI/CD pipeline to automatically test your detections. Lastly, the presenter will share how CD can automatically deliver the detection rules to the SIEM via either a package or over an API.
    - Rethinking Detection Engineering – Jared Atkinson (SO-CON 2020)
      - Psychologist Jean Piaget is renown for his investigation into cognitive development and how we learn to deal with abstract concepts. In Information Security we often deal with abstract concepts like "find evil" or "detect malicious activity," however it is often difficult to break these down from the abstract concept into their specific elements. In this talk, I will discuss my perspective of common follies of abstraction in detection, triage, and investigation and how I approach breaking down problems into discrete components.
    - Understanding Technique Abstraction for Detection Engineers - Jared Atkinson, Luke Paine, and Jonny
      - Have you ever struggled to build a detection because you didn't know where to start? In sports, it is important to understand strengths and weaknesses of your opponent. Before a game, teams study their opponents in painstaking detail to make sure they understand what they are up against. Not only can this approach win championships, but it can help build powerful detections. In this workshop you will learn to look past the superficial nature of attack tools, revealing how tools are a simple abstraction layer hiding the inner workings of a technique. We will use this understanding to discuss and demonstrate how this understanding can be used to build detections beyond simple tool signatures.
    - Converting Blue Team Expertise of Customer Networks into Advanced Host-Based Alerting - Stephen Spence(2020)
      - What happens when the dream of host event log aggregation is realized and you have to figure out what to do with ALL that data? Through solutions such as Splunk and the Elastic Stack, many blue teamers finally have access to millions/billions of windows event logs, Sysmon, endpoint protection logs, and other log types. Often the challenge of creating alerts off this data looks a lot like attempt to implement Sigma and hope you can alert on evil. This presentation will describe how to transform a blue team’s knowledge of a customer’s network into advanced signature creation. We will cover my experiences in tuning to a customer’s traffic and creating alerts on the negative space, simplify complex Sigma rules, future proof alerts against schema changes, and consider search performance at the same time. Additionally this presentation will show how to take events collected during Red Team engagements and build alerting that is specific to the customer environment that will pay dividends in the future.
    - Resilient Detection Engineering - Olaf Hartong(WWHF Deadwood2020)
    - A Voyage to Uncovering RPC Telemetry – Jonathan Johnson (SO-CON 2020)
      - Remote Procedure Calls (RPC) is a core component of the Windows Operating System. This technology is commonly leveraged by adversaries when performing various attacks. "A Voyage to Uncovering Telemetry" provides a walk-through on how Jonathan studied this technology to uncover various telemetry sources that provides detection engineers with the proper insight needed to identify this behavior, whether benign or malicious.
    - Identifying Novel Malware at Scale - Pedram Amini(SANS HackFest&Ranges Summit2020)
      - It's no secret that client-side attacks are a common source of compromise for many organizations. Web browser and e-mail borne malware campaigns target users by way of phishing, social engineering, and exploitation. Office suites from vendors such as Adobe and Microsoft are ubiquitous and provide a rich and ever-changing attack surface. Poor user awareness and clever social engineering tactics frequently result in users consenting to the execution of malicious embedded logic such as macros, JavaScript, ActionScript, and Java applets. In this talk, we'll explore a mechanism for harvesting a variety of these malware lures for the purposes of dissection and detection. We'll explore mechanisms for clustering and identifying "interesting" samples. Specifically, we're on the hunt for malware lures that can provide a heads up to defenders on upcoming campaigns as adversaries frequently test their lures against AV consensus. Multiple real-world examples are provided, proving that an astute researcher, can harvest zero-day exploits from the public domain.
    - Discovering C&C in Malicious PDF with obfuscation, encoding and other tech - Filip Pires(BSides Athens2021)
    - Detection mapping - how does your coverage compare to ATTACK.pdf - Olaaf Hartong
    - Rethinking Detection Engineering: Threat Scoring for Prioritization – Josh Prager (SO-CON 2020)
      - The complexity of defensive tooling in the current industry can cause an abundance of alerts that are often dismissed without substantial justification. With the necessary context added to alert event data, we can decipher exactly what the analyst needs to know to properly prioritize and triage alerts. In this talk, we'll describe our approach to building a prioritization of composite event fields and defining a score to address alerts programmatically. We will show you how creating questions via the composite events and scoring those same questions can alter the priority list of alerts as they come into the queue.
- Papers
- Command-Line Obfuscation
  - Tools
    - Flerken
      - This talk first shares some key observations on CLOB such as its attack vectors and analyzing strategies. Then we give a detailed design of Flerken. The description is divided in two parts, namely Kindle (for Windows) and Octopus (for Linux). Respectively, we will show how human readability can serve as an effective statistical feature against PS/CMD obfuscation, and how dynamic syntax parsing can be adopted to eliminate false positives/negatives against Bash CLOB. The effectiveness of Flerken is evaluated via representative black/white command samples and performance experiments.
- Detection Ideas & Techniques
  - Detection Ideas & Rules
    - Every day a number of Threat Intelligence reports come into the world. Prepared by different vendors and teams almost none of them contain ready to use detection ideas and rules. In most cases we get only list of IOCs associated with particular threat actor. From my perspective, the reason of that is that DFIR teams do their job perfectly, but detection engineering is simply not their job. It is our - Threat Hunters' job. The idea of this repository is to analyze public Threat Intelligence reports, interesting TTPs, tools and various offensive tradecraft to generate ready to use detection ideas and rules implementations, which can be used by threat hunters and security monitoring teams.
- Methodologies
  - Articles/Blogposts/Writeups
    - Capability Abstraction - Jared Atkinson
      - This is the first of a multipart blog series by the SpecterOps detection team. The goal of this series is to introduce and discuss foundational detection engineering concepts. To make these concepts as consumable as possible, we are focusing the entire series around Kerberoasting. Focusing on this technique allows readers to focus on the strategies presented in each article instead of worrying about the details of the technique itself. The focus of this post is a concept we call “capability abstraction.” The idea is that an attacker’s tools are merely an abstraction of their attack capabilities, and detection engineers must understand how to evaluate abstraction while building detection logic.
    - Getting Started with ATT&CK: Detection and Analytics - John Wunder(2019)
    - Introducing the Funnel of Fidelity - Jared Atkinson(2019)
    - Detection Spectrum - Jared Atkinson(2020)
    - Capability Abstraction - Jared Atkinson(2020)
    - Capability Abstraction Case Study: Detecting Malicious Boot Configuration Modifications - Micahel Barclay(2021)
  - Talks/Presentations/Videos
- Metrics
  - Articles/Blogposts/Writeups
    - The Detection Maturity Level Model - Ryan Stillion(2014)
    - How to Measure Threat Detection Quality for an Organization? - Anton Chuvakin(2022)
  - Talks/Presentations/Videos
- YARA-related
  - Articles/Blogposts/Writeups
  - Talks/Presentations/Videos
  - Tools
    - ReversingLabs YARA Rules
- Tools
  - File Analysis
    - entropy
      - entropy is a simple command-line tool to calculate the entropy of files.
  - Helper Libraries
    - huntlib
      - A Python library to help with some common threat hunting data analysis operations
  - Network Traffic
    - hallucinate
      - One-stop TLS traffic inspection and manipulation using dynamic instrumentation
    - PCAP-ATTACK
      - Container of PCAP captures mapped to the relevant attack tactic.
  - Testing
    - Automata
      - Blogpost
      - Automata is a tool to detect errors early and measure the Effectiveness of SIEM rules against the behaviors that the rule was developed to work against, ensuring that the whole process of data collection, parsing, and query of security data is working properly and alert when things don't work as intended.
    - atomic-threat-coverage
      - Atomic Threat Coverage is highly automatable framework for accumulation, development and sharing actionable analytics.
Threat Hunting
- 101
  - 101
    - Cyber KillChain
    - The Alexiou Principle - cepogue(2009)
    - Cyber Threat Hunting | Chris Brenton | October 2020 | 4 Hours
      - Chris Brenton from Active Countermeasures is conducting another free, one-day, Cyber Threat Hunting Training online course! One of the biggest challenges in security today is identifying when our protection tools have failed and a threat actor has made it onto our network. In this free, 4-hour course, we will cover how to leverage network and host data to perform a cyber threat hunt. The course includes hands-on labs using packet captures of various command and control channels. We also discuss how you can use our new Sysmon tool BeaKer to detect attacks on the host with Sysmon... for free! The labs enable you to apply what you've learned using various open-source tools. By the end of the course, you’ll understand the tools and techniques needed to perform compromise assessments within your own environment. While the course will be available later for download, live attendees will receive a "Cyber Security Threat Hunter Level-1" certificate.
    - attack-coverage
      - An excel-centric approach for managing the MITRE ATT&CK® tactics and techniques. The Excel file AttackCoverage.xlsx can be used to get a coverage measure of MITRE ATT&CK® tactics and techniques, in terms of detections rules. Working as DFIR consultants for different companies, with different SOCs and technologies in place, it was needed a simple and portable way to get a sort of awareness about which attackers' tactics/techniques a customer is able to detect and, more important, what is missing.
    - Threat Hunting Principles - SecureWorksCTU(2021)
  - Articles/Writeups
    - The Pyramid of Pain - David Bianco(2014)
    - Incident Response is Dead… Long Live Incident Response - Scott J Roberts(2015)
    - A Simple Hunting Maturity Model - detect-respond.blogspot (2015)
    - The Origin of Threat Hunting - TaoSecurity(2017)
    - Detecting the Unknown: A Guide to Threat Hunting - UK Gov(2019)
    - Expanding on Pyramid of Pain - limbenjamin(2020)
    - The Cyber Hunting Maturity Model - Sqrrl(2015)
    - Threat Hunting - Getting Closer to Anomalous Behavior - Jack Crook(2016)
    - The ThreatHunting Project Annotated Reading List
    - "I hereby declare the Law Of A Threat Hunter (LOATH): 𝘍𝘰𝘳 𝘦𝘷𝘦𝘳𝘺 𝘵𝘸𝘰 𝘮𝘰𝘴𝘵 𝘥𝘪𝘴𝘵𝘢𝘯𝘵 𝘵𝘦𝘤𝘩𝘯𝘰𝘭𝘰𝘨𝘪𝘦𝘴 𝘵𝘩𝘦𝘳𝘦 𝘦𝘹𝘪𝘴𝘵 𝘢 𝘥𝘦𝘷𝘦𝘭𝘰𝘱𝘦𝘳 𝘵𝘩𝘢𝘵 𝘸𝘪𝘭𝘭 𝘣𝘳𝘪𝘯𝘨 𝘵𝘩𝘦𝘮 𝘵𝘰𝘨𝘦𝘵𝘩𝘦𝘳." - HexacornTweet
    - The Threat Hunting Reference Model Part 2: The Hunting Loop - Sqrrl
    - The Who, What, Where, When, Why and How of Effective Threat Hunting - Robert Lee, Rob Lee(2016)
    - Building Threat Hunting Strategies with the Diamond Model - Sergio Caltagirone(2016)
    - Cyber Threat Hunting (1): Intro - Samuel Alonso(2016)
      - Part 2: Getting Ready
      - Part 3: Hunting in the perimeter
    - Cyber Hunting: 5 Tips To Bag Your Prey - David J. Bianco
    - Billions and Billions of Logs; Oh My - Jack Crook(2017)
    - Data Science Hunting Funnel - Austin Taylor(2017)
    - Demystifying Threat Hunting Concepts - Josh Liburdi(2017)
      - This post is about demystifying threat hunting concepts that seem to trip up practitioners and outsiders.
    - The Role of Evidence Intention - Chris Sanders(2018)
    - DeTT&CT: Mapping your Blue Team to MITRE ATT&CK™ - Marcus Bakker(2019)
      - DeTTECT - Detect Tactics, Techniques & Combat Threats
    - A Deep Drive on Proactive Threat Hunting - Nisha Sharma(2020)
    - On TTPs - Ryan Stillions(2020)
      - [...]I set off a few months ago on a personal quest. I wanted to see if I could locate any official citations that attempted to clearly define, compare or contrast "TTPs" in a cyber context, and show how they could be used both individually and jointly with other models to further advance our work in the context of things above and beyond atomic Indicators of Compromise (IOCs). In this blog post I'll share with you what I found regarding the definitions of "TTPs", and then transition into how I believe they apply to incident detection and response.
    - Hunting mindmaps - sbousseaden
      - Summarized Overview of different hunting paths an Analyst can take per EventId or technique.
    - Threat Hunting - Zero to Hero - Slavi Parpulev(2020)
    - The PARIS Model
    - Practical security engineering: Stateful detection - Samir Bousseaden(2020)
    - Threat Hunting. Why might you need it - CyberPolygon(2021)
    - Thoughts on Assessing Threat Actor Intent & Sophistication - Harlan Carvey(2021)
    - A Guide to Threat Hunting in a SOC - @paulsec4(2021)
    - Threat Hunting in action - CyberPolygon(2021)
  - Talks & Presentations
    - Threat Hunting Workshop - Methodologies for Threat Analysis - RiskIQ
    - Threat Hunting 101: Become The Hunter - Hamza Beghal(HITBGSEC 2017)
    - Threat Hunting, The New Way - In Ming, Wei Chea(HITCon Pacific2017)
    - Advanced threat hunting with open-source tools and no budget - Joseph DePlato(SecureWV/Hack3rcon 2018)
      - This talk is designed to provide you the skills necessary to hunt for malicious actors on the networks you defend. I will teach you how to do this using primarily Open-Source software and technologies. You CAN have effective cybersecurity on a limited budget. Part 1: OSINT Network defenses - talk through creating an open-source network intrusion detection sensor leveraging a Raspberri Pi and Suricata. We have successfully deployed these sensors on network up to 500 endpoints. We will cover the basics of what Suricata is as well as how to use a Pi for better visibility within a network. Part 2: OSINT Threat Intel - talk through using a number of different tools for faster false positive detection. Will also speak about how to automate some of the OSINT feeds for the Suricata sensor - daily OSINT updates protecting the network. Part 3: Now that we have some tooling in place - how do we look for anomalous activity. Will cover how to approach an investigation, define attackers and define a compromise. Part 4: Introduction of our F3EA Framework for threat hunting. Explore all 5 sections and define what each are and how they relate to the overall investigation. The Framework is iterative and feeds itself. Part 5: Threat Hunting models - practical examples of how to hunt and a number of common techniques that we have found highly successful.
    - A Process is No One: Hunting for Token Manipulation - Jared Atkinson, Robby Winchester(Derbycon2018)
      - Does your organization want to start Threat Hunting, but you’re not sure how to begin? Most people start with collecting ALL THE DATA, but data means nothing if you’re not able to analyze it properly. This talk begins with the often overlooked first step of hunt hypothesis generation which can help guide targeted collection and analysis of forensic artifacts. We will demonstrate how to use the MITRE ATTACK Framework and our five-phase Hypothesis Generation Process to develop actionable hunt processes, narrowing the scope of your Hunt operation and avoiding “analysis paralysis.” We will then walk through a detailed case study of detecting access token impersonation/manipulation from concept to technical execution by way of the Hypothesis Generation Process.
    - On the Hunt: Hacking the Hunt Group - Chris Silvers, Taylor Banks(NolaCon2018
      - Goal is to motivate listeners to be better cyber practitioners, employees, and patients and end result will be better patient medical record security for all of society. In theory
    - Reducing The Breach Detection Gap - Markus Hubbard(DerpCon2020)
      - Methodologies on identifying signs of compromise incorporating e-mail schema, DNS, expanding web structures, robots.txt, honeyports, honeysql, honeypot accounts, honeypot workstations, canary documents, file modification alerts, etc.
    - Hunting by Numbers: Defensive Hunting Program and Outcomes | Chris Crowley | WWHF Deadwood 2020
      - Crowley walks through the steps he wants Network Defenders to go through to hunt. Step by step on how to prepare, how to select hunts, data to collect in advance, data to collect along the way, and how to put the tools away when you're done so the next hunt is more productive and effective. He discusses easy ways to report on the effort with tangible outputs (including easy to collect metrics) that demonstrate the value of hunting to your management and constituents. This talk presents your new way to establish the routing for hunting, explains how this relates to SIEM Use Cases, and gives a winning strategy to gain the time to actually take this proactive measure in your organization. Less "we don't have time to hunt" and more "hold my flask and stand back."
    - Everything You've Been Told About Threat Hunting is a Lie | Lesley Carhart | WWHF Deadwood 2020
      - As leaders, we've been told that to Do Security in the 20s, we have to have the capacity to "Threat Hunt". As individual contributors, we've been told that traditional SOC analysts are on the way out, to be replaced by mystical "threat hunters". So, what is threat hunting, really? How can you do it in your environment today, what value does it bring, and what people and technologies does it require? How do you build a threat hunting program with a big budget or a tiny one? What skills do you need to grow to be great at threat hunting? These questions and more will be tackled as we discuss why we need to threat hunt and what it practically can and cannot do.
    - When Worlds Collide: OSS Hunting & Adversarial Simulation | BHIS & Friends(2020)
      - "The group will discuss Roberto Rodriguez (@Cyb3rWard0g) and Nate Guagenti’s (@neu5ron) development and maintenance of the HELK project while focusing on the ongoing development of Mordor, Datasets, and Azure Resource Manager templates. Joining the world-class hunters is Marcello Salvati (Byt3bl33d3r), developer of CrackMapExec and SILENTTRINITY to continue the discussion of OSS adversarial simulation. John Strand will add commentary on the history of adversarial simulation, hunting, and where the industry may be headed."
    - Find_Evil - Threat Hunting Anurag Khanna(SANS2020)
      - Today, organizations are constantly under attack. While security teams are getting good at monitoring and incident response, the frontier to conquer is proactively looking for evil in the environment. Threat hunting is one of the ways in which organizations can proactively look for threats. This talk would discuss the fundamentals of threat hunting, what the hunting teams should look for and how to collect and analyze relevant data. We will discuss some of the recipes to perform threat hunting.
    - Becoming a Threat Hunter: This Is One Way - Jason Wood(Texas Cyber Summit2021)
  - Talks/Presentations/Videos
    - Objectively Measuring Hunt Value - Justin Kohler, Patrick Perry(BSidesAugusta 2018)
    - Quantify Your Hunt: Not Your Parents’ Red Team - Devon Kerr, Roberto Rodriguez(SANS Threat Hunting Summit 2018)
    - BSides Charm2018 Version
      - This presentation builds on the MITRE ATT&CK framework by explaining how to measure the coverage and quality of ATT&CK, while demonstrating open-source Red Team tools and automation that generate artifacts of post-exploitation.
  - Papers
    - Hunt Evil: Your Practical Guide to Threat Hunting - threathunting.net
    - Huntpedia - Sqrrl
    - Threat Hunting: Open Season on the Adversary - Eric Cole(2016)
    - Mental Models for Effective Searching - Chris Sanders
    - A Practical Model for Conducting Cyber Threat Hunting - Dan Gunter, Marc Seitz(2018)
      - There remains a lack of definition and a formal model from which to base threat hunting operations and quantifying the success of said operations from the beginning of a threat hunt engagement to the end that also allows analysis of analytic rigor and completeness. The formal practice of threat hunting seeks to uncover the presence of attacker tactics, techniques, and procedures (TTP) within an environment not already discovered by existing detection technologies. This research outlines a practical and rigorous model to conduct a threat hunt to discover attacker presence by using six stages: purpose, scope, equip, plan review, execute, and feedback. This research defines threat hunting as the proactive, analyst-driven process to search for attacker TTP within an environment. The model was tested using a series of threat hunts with real-world datasets. Threat hunts conducted with and without the model observed the effectiveness and practicality of this research. Furthermore, this paper contains a walkthrough of the threat hunt model based on the information from the Ukraine 2016 electrical grid attacks in a simulated environment to demonstrate the model’s impact on the threat hunt process. The outcome of this research provides an effective and repeatable process for threat hunting as well as quantifying the overall integrity, coverage, and rigor of the hunt.
    - Generating Hypotheses for Successful Threat Hunting - Robert M. Lee, David Bianco
      - Threat hunting is a proactive and iterative approach to detecting threats. Although threat hunters should rely heavily on automation and machine assistance, the process itself cannot be fully automated. One of the human’s key contributions to a hunt is the formulation of a hypotheses to guide the hunt. This paper explores three types of hypotheses and outlines how and when to formulate each of them.
- Building a Program
  - Articles/Blogposts
    - How to start Threat Hunting (even if your team is small!) - svch0st(2020)
    - Building and Maturing Your Threat Hunting Program - David Szili(2019)
  - Talks/Presentations/Videos
    - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles - Kevin Foster, Matt Schneck, Ryan Andress( BSides Philadelphia 2017)
      - Threat hunting is a hot topic spurred on by the thought that it,s not a matter of if, but when, your organization will be breached. Mature security organizations are shifting in their approach from solely relying on reactive response and black box security tools to proactive hunting. This shift in approach requires large amounts of network and endpoint data to tie together attacker tools, tactics, and procedures. Security teams often have their hands tied due to limited budgets, politics and their ability to affect change with what information gets logged (just try getting a DNS admin to check a box that says "Debug" in prod). Hypothesis driven data acquisition can be used to overcome environmental challenges, provide a specific goal, and reduce analysis paralysis. This presentation will discuss hypothesis driven threat hunting using free and commercial tools for organizations which face common corporate roadblocks.
    - [We're going on a Threat Hunt, Gonna find a bad-guy. - Todd Sanders(Derbycon2017)](https://www.irongeek.com/i.php?page=videos/derbycon7/t218-were-going-on-a-threat-hunt-gonna-find-a-bad-guy-todd-sanders *-Purpose-Driven-Hunt:-What-do-I-do-with-all-this-data?-Jared-Atkinson,-Robby-Winchester(Derbycon2017)
      - Does your organization want to start Threat Hunting, but you’re not sure how to begin? Most people start with collecting ALL THE DATA, but data means nothing if you’re not able to analyze it properly. This talk focuses on the often overlooked first step of hunt hypothesis generation which can help guide targeted collection and analysis of forensic artifacts. We will demonstrate how to use the MITRE ATTACK Framework and our five-phase Hypothesis Generation Process to develop actionable hunt processes, narrowing the scope of your Hunt operation and avoiding “analysis paralysis.” We will then walk through a case study of Golden Ticket detection from concept to technical execution by way of the Hypothesis Generation Process. Along the way, we will detail some of the most common Golden Ticket indicators and will release a new PowerShell script for extracting Kerberos ticket information without any dependencies on external binaries.
    - Host-Hunting on a Budget - Leo Bastidas(BSidesAugusta2019)
    - Threat Hunting and Other Arcane Magic - (BSidesRochester2019)
      - "Threat hunting is often misunderstood. This talk is meant to dispel some misconceptions as well as build a foundation to perform hunts in any network. It’s not about just tools or just data, you’ll need both and an understanding of the stories they tell. After building the fundamentals, we will walk though some hunt scenarios to find those dark hooded intruders. Happy hunting."
    - Evolving the Hunt: A Case Study in Improving a Mature Hunt Program - David J Bianco, Cat Self(Sans DFIR Summit2021)
      - As a major U.S. retailer with a strong cybersecurity focus, Target has long had a functional, mature threat hunting program. When David Bianco took over responsibility for the hunting program in early 2019, leadership’s key question was “How can we do even better?” But what does “better” mean for a hunting program, and how do you get from where you are now to where you want to be? In this presentation, we’ll talk about coming into an existing threat hunting program, prioritizing areas for improvement, and then implementing those improvements to make a great hunting program even better. Attendees will learn the key functions of a threat hunting program and how to evaluate the current hunting program maturity level, set an appropriate maturity improvement goal, identify and prioritize possible program changes to support the desired improvements, and understand how and why these efforts work (or don’t work!).
    - How to make intelligence, hunting, and response BFFs - Kamil Bojarski(x33fcon2021
    - Continuous Threat Hunting: A Practical Webinar - Justin Vaicaro(2020)
      - "Threat hunting is a vital but often misunderstood practice for organizations and security teams. In order to be successful, a threat hunting program must be proactive, continually tuned, and optimized to align with the organization’s goals. Further, realistic detections must be built around the direct threats that are specifically targeting the organization, its business vertical, and geographical presence. In this practical webinar, Randy Pargman, Senior Director of Threat Hunting & Counterintelligence at Binary Defense, and Justin Vaicaro, Senior Incident Response Consultant at TrustedSec, will share methods and strategies to cultivate a more effective threat hunting program."
- Resources
  - awesome-threat-detection
  - Are the Attackers Out of Our Network? A Guide to Successful Threat Hunting - TrustedSec
- Non-101 General
  - Articles/Blogposts/Writeups
- APT Hunts
  - Articles/Blogposts/Writeups
- Methodologies
  - 'Data Driven Approach'
    - Threat Hunting Research Methodology: A Data Driven Approach by Roberto & Jose Luis Rodriguez(InsomniHack2019)
      - Threat hunting as a process is still being defined for many organizations across various industries. Hence, the justification of its budget becomes even harder. Some security teams don’t have a formalized team in place, and they see threat hunting as an informal, ad-hoc procedure where it becomes the responsibility of all Cyber employees to find malicious activity. Others see threat hunting as a formalized process that requires a full-time team focused more on creating detection strategies for adversaries even when they are not in the production environment. No matter how it is defined, there is still uncertainty pertaining to the impact that threat hunting has to the security posture of an organization. In addition, organizations believe that buying more tools and hiring more people would solve their problem. However, they disregard the fact that they might not even have the right data to start with. In this presentation, we will share a threat hunting research methodology that focuses on assessing what an organization has and needs from a data perspective to validate the detection of an adversary. This talk will show organizations how they can assess the collection and quality of their data and create data analytics to set their teams up for more effective engagements in production networks.
    - The Threat Hunter Playbook
      - The Threat Hunter Playbook is a community-driven, open source project to share detection logic, adversary tradecraft and resources to make detection development more efficient. All the detection documents in this project follow the structure of MITRE ATT&CK categorizing post-compromise adversary behavior in tactical groups and are available in the form of interactive notebooks.
  - 'Hunting Loop'
    - The Hunting Loop - Sqrrl(2015)
    - A Framework for Cyber Threat Hunting - Sqrrl
  - 'A Practical Model For Conducting Cyber Threat Hunting'
    - A Practical Model for Conducting Cyber Threat Hunting - Dan Gunter, Marc Seitz(2018)
  - TaHiTI
    - TaHiTI Threat Hunting Methodology
    - TaHiTI: a threat hunting methodology (whitepaper)
- Data Analysis
  - Articles/Blogposts/Writeups
    - An In-Depth Look Into Data Stacking - M-Labs
      - Data stacking is the application of frequency analysis to large volumes of similar data in an effort to isolate and identify anomalies. In short, data stacking is an investigative technique that can be used to find a needle in a digital haystack. It involves an iterative process of reducing large amounts of data into manageable chunks that can be consumed and investigated.
    - Defining ATT&CK Data Sources, Part I: Enhancing the Current State - Jose Luis Rodriguez(2020)
    - Defining ATT&CK Data Sources, Part II: Operationalizing the Methodology - Jose Luis Rodriguez(2020)
  - Analysis of
    - Articles/Blogposts/Writeups
    - Talks/Presentations/Videos
      - Top 10 2015-2016 compromise patterns observed & how to use non-traditional Internet datasets to detect & avoid them - Arian J Evans, James Pleger(Derbycon2016)
        
        We have seen a consistent set of patterns in attacker behaviors, and breach targets, over the last year. We often see where adversaries are repeat offenders - reusing the same recon techniques, and the same threat infrastructure (in new ways), to attack the same target again - if the target continues to play whack-a-mole treating hardening systems and investigating breaches as one-off events. This presentation will focus on the common patterns of compromise, and adversarial behavior in the early stages of the "kill-chain", leading up to the first attack. The goal for Red-teams & vuln-managers is to show how adversaries do recon and setup, to enable you to measure & manage your attack surface more realistically to how your adversaries will map it out. The goal for Blue-teams & IR is to show new patterns and pivots we see adversaries make, and what Internet security datasets you can use to pinpoint them.
      - StringSifter: Learning to Rank Strings Output for Speedier Malware Analysis - Philip Tully, Matthew Haigh, Jay Gibble, Michael Sikorski(Derbycon2019)
        
        In static analysis, one of the most useful initial steps is to inspect a binary's printable characters via the Strings program. However, running Strings on a piece of malware inevitably produces noisy strings mixed in with important ones, which can only be uncovered after sifting through the entirety of its messy output. To address this, we are releasing StringSifter: a machine learning-based tool that automatically ranks strings based on their relevance for malware analysis. In our presentation, we'll show how StringSifter allows analysts to conveniently focus on strings located towards the top of its predicted output, and that it performs well based on criteria used to evaluate web search and recommendation engines. We?ll also demonstrate StringSifter live in action on sample binaries.
  - Analytics Creation & Curation
    - Articles/Blogposts/Writeups
      - Coefficient of variation - Wikipedia
        
        "In probability theory and statistics, the coefficient of variation (CV), also known as relative standard deviation (RSD), is a standardized measure of dispersion of a probability distribution or frequency distribution. It is often expressed as a percentage, and is defined as the ratio of the standard deviation <snip>to the mean<snip>."
      - Introducing Explainable Threat Intelligence - Tomislav Peričin(2020)
      - Let's build a Full-Text Search engine - Artem Krylysov(2020)
      - Building a full-text search engine in 150 lines of Python code - Bart de Goede(2021)
      - Hunting for anomalies with time-series analysis - m365guy(2021)
      - Evadere Classifications - Jonathan Johnson(2021)
  - Presenting Data
    - How to numerically represent semi-structured log data for anomaly detection? - Marcin Kowiel(PyData Warsaw2019)
  - Datasets
    - Security Datasets
      - The Security Datasets project is an open-source initiatve that contributes malicious and benign datasets, from different platforms, to the infosec community to expedite data analysis and threat research.
    - Public dataset of Cloudtrail logs from flaws.cloud - Scott Piper(2020)
    - APT29 Evals Detection Hackathon May 2nd, 2020
    - Suricata PT Open Ruleset
      - The Attack Detection Team searches for new vulnerabilities and 0-days, reproduces it and creates PoC exploits to understand how these security flaws work and how related attacks can be detected on the network layer. Additionally, we are interested in malware and hackers’ TTPs, so we develop Suricata rules for detecting all sorts of such activities.
  - Visualization
    - Windows & Sysmon Events visualization using Neo4j & Python - Anastasios Chatziefstratiou(BSides København2021)
      - My presentation is divided in 2 parts, theory and tool demonstration. On the theory I will highlight the general idea behind the tool and how can help Cyber security teams. On the demonstration part, I will utilize my python3 script (Epimitheus) in order to import the Windows & Sysmon events as well as querying the Neo4j based on Mitre ATT&CK TTPs.
    - Visualize Windows Logs With Neo4j - Pwntario Team(2020)
  - Tools
    - Danger-Zone
      - Correlate data between domains, IPs and email addresses, present it as a graph and store everything into Elasticsearch and JSON files.
    - freq
      - frequency analysis script;
      - "While sitting in SANS SEC511 I listened to @sethmisenar laement the difficulty in using existing tools to detect DGA (Domain Generation Algorithm) hostnames often used by malware. There are lots of AI based tools out there that do this but some are rather complex. I thought I could quickly write a tool that would work. In about 30 minutes I threw together some old code I had lying around from a SQL Injection tool I worked on and I had a working proof of concept. freq.py was born and it worked pretty well. A year later @securitymapper had me wrap it in a web interface so he could query it from a SIEM and then the tool took off. It turns out to be a pretty effective technique and gained some popularity and wide use! This is a rewrite of the tool that incorporates some lessons learned and performance enhancements."
    - huntlib
      - A Python library to help with some common threat hunting data analysis operations
    - Flare
      - Flare is a network analytic framework designed for data scientists, security researchers, and network professionals. Written in Python, it is designed for rapid prototyping and development of behavioral analytics, and intended to make identifying malicious behavior in networks as simple as possible.
    - Brim
      - Desktop application to efficiently search and analyze super-structured data. Powered by Zed.
- Email-Logs
  - Articles/Blogposts/Writeups
    - Threat Hunting and Detection with Email Logs - Mehmet Ergene(2020)
- Hunt Experiences/Demonstrations of
  - Articles/Blogposts/Writeups
  - Talks/Presentations/Papers
    - License to Kill: Malware Hunting with the Sysinternals Tools
    - Detect Me If You Can - Ben Ten(Derbycon2017)
      - As long as there is a "Patch Tuesday", and software has bugs, there will always be an attack vector to which defensive controls are unable to defend. This is because most defensive strategies have focused on stopping attacks at their initial vector. In this talk, I will go over how I attack and bypass most deflection controls and go under the detection radar. I will then highlight the areas where defenders can begin to build a detection defense which will identify attacker behavior regardless of the initial vector. I will run through attacks I have used, which bypass several deflective controls, and show you how you can create detection controls to detect me; that is, if you can.
    - Advanced Attack Detection - William Burgess, Matt Watkins(Securi-Tay2017)
      - In this talk, we’ll explain some of the technical concepts of threat hunting. We will be looking at what is beyond traditional signature detection – the likes of AV, IPS/IDS and SIEMs, which in our experience are ineffective – and detailing some of the ways you can catch real attackers in the act. As a case study, we’ll look at some of the specifics of common attack frameworks - the likes of Metasploit and Powershell Empire - walking through an example attack, and showing how they can be detected. From large-scale process monitoring to live memory analysis and anomaly detection techniques, we will cover some of the technical quirks when it comes to effective attack detection.
    - Looking for Needles in Needlestacks w/ Threat Hunting Toolkit - Derek Banks & Ethan Robish(BHIS2021)
      - Slides
      - "Ever feel lost when trying to perform a threat hunt on your network? Join us for a peek at a threat hunting scenario where we uncover an advanced command and control channel in a real network. We'll give you background on our threat hunting process, show you the techniques we use, and discuss the problems we encounter hunting modern networks. We'll even introduce you to a toolkit that has helped us become more effective by speeding up our process."
- (Malicious) Insider Hunting
  - Articles/Blogposts/Writeups
    - More Behavioral Hunting and Insider Data Theft - Jack Crook(2021)
  - Talks/Presentations/Papers
- Metrics
  - The Hunting Cycle and Measuring Success - findingbad.blogspot(2016)
  - Creating & Tracking Threat Hunting Metrics - Josh Liburdi(2020)
  - Confidently Measuring Attack Technique Coverage by Asking Better Questions - Matt Graeber(BSides Augusta2021)
    - If a tree falls down in the woods and no one is around to hear it, did it make a sound? I don’t know so let’s build a sensor to find out! What does a tree falling in the woods sound like? Does it sound different depending on the tree and the specific forest it’s in? Does it sound distinct from a deer falling on its face? Hyper-rational inquiring minds must know
- Serialization Attacks
  - Tools
    - heyserial
      - Programmatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types
- WebShells
  - Articles/Blogposts/Writeups
    - Ghost in the shell: Investigating web shell attacks - MSDART/MSTIC(2020)
  - Talks/Presentations/Videos
    - Hunting for Exploit Kits - Joe Desimone(Derbycon2016)
    - Hunting Webshells: Tracking TwoFace - Josh Bryant, Robert Falcone(Defcon19)
- Tools
  - threathunting
    - Assorted, MIT licensed, threat hunting rules from @bradleyjkemp
  - TheThreatHuntLibrary
    - A collection of organised hunts based of yaml files to create markdown pages for analyst use.
  - AutonomousThreatSweep
    - The repository provides threat hunting queries for various threats/attacks that can be leveraged directly within the Securonix Snypr platform.
  - Wild Hunt
    - A collection of tools and offensive techniques aimed at actively finding adversaries
  - Advanced hunting queries for Microsoft 365 Defender
    - This repo contains sample queries for advanced hunting in Microsoft 365 Defender. With these sample queries, you can start to experience advanced hunting, including the types of data that it covers and the query language it supports. You can also explore a variety of attack techniques and how they may be surfaced through advanced hunting.
  - Hunts - Threat Hunting Project
  - The ThreatHunting Project
    - An informational repo about hunting for adversaries in your IT environment.
  - grapl
    - Grapl is a Graph Platform for Detection and Response with a focus on helping Detection Engineers and Incident Responders stop fighting their data and start connecting it. Grapl leverages graph data structures at its core to ensure that you can query and connect your data efficiently, model complex attacker behaviors for detection, and easily expand suspicious behaviors to encompass the full scope of an ongoing intrusion.
Other
- ESXi
  - Articles/Writeups
    - ESXi Security Events Log Monitoring - communities.vmware
    - Analyze ESXi Logs for Security-Related Messages
  - Tools
    - sexilog
      - SexiLog is a specific ELK virtual appliance designed for vSphere environment
- ICS
  - Articles/Blogposts/Writeups
  - Talks/Presentations/Papers
    - Hunting for Threats in Industrial Environments and Other Scary Places - Nick Tsamis(BSides Charm2019)
      - Threat hunting in Industrial Control Systems is a proactive tactic that can be employed by network defenders to gain familiarity with network terrain and to seek out malicious behavior, presence of vulnerabilities, or otherwise unknown activity. Unique constraints in operational technology environments present significantly different challenges than more standard computing environments. This presentation provides the audience with an inside look into challenges that ICS threat hunters face.
- Slack
  - Slack API Auditor
    - Provides a quick method of collecting Slack access logs and integration logs, then forwards them via Logstash.
OSQuery
- 101
  - osquery
    - osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Available for Linux, macOS, Windows, and FreeBSD.
  - Table Schema v4.3
  - Getting Started Documentation
  - Optimizing Queries in OSQuery - Dennis Griffin(2018)
- Articles/Blogposts/Writeups
  - osquery Across the Enterprise - Chris L(Palantir 2017)
  - Palantir osquery Configuration The goal of this project is to provide a baseline template for any organization considering a deployment of osquery in a production environment.
  - Blue Team Diary, Entry #1: Leveraging Osquery For Enhanced Incident Response & Threat Hunting - Dimitrios Bougioukas(2019)
- Talks/Presentations/Videos
  - Leveraging Osquery For Enhanced Incident Response & Threat Hunting - Dimitrios Bougioukas(2019)
    - This video accompanies eLearnSecurity's Blue Team Diary, Entry #1: Leveraging Osquery For Enhanced Incident Response & Threat Hunting post on medium.
  - Osquery across compliance, monitoring, risk and threat hunting - Hugh Neale(QueryCon2019)
    - Stories, use cases and lessons learnt from the front line: Hugh will demonstrate how powerful osquery is across compliance, monitoring, risk IAM and threat hunting. The goal is to help build a complete picture of your IT estate and security posture. This talk is aimed at IT and Security operations. Zercurity has been using osquery in production workloads from startups to listed companies. They use osquery for inventory management, monitoring, compliance, risk, vulnerability management and IAM to name a few. Hugh will share some of their takeaways over the last few years and tell you about some of the things you can build atop osquery.
    - Slides
  - Monitoring Ephemeral Infrastructure with osquery - Matt Jane(Querycon219)
    - Modern infrastructure and deployment methods, as well as web-scale infrastructure have brought about a new paradigm in infrastructure management. Short lived and ephemeral resources allow applications to scale up and down on demand. Unfortunately this means that one of the primary information gather methods of osquery, scheduled queries, becomes far less useful if queries are scheduled for a longer interval than the infrastructure will exist. This doesn’t mean osquery and scheduled queries are no longer useful, far from it. It simply means that we need to adjust our way of thinking a bit and adapt our methods of information gathering to overcome these new issues.
    - Slides
  - Linux security event monitoring with osquery - Alessandro Gario(Querycon2019)
    - This talk introduces security event monitoring on Linux, and our lessons learned from attempts to implement it within osquery. Our first experience with osquery event monitoring was rewriting its use of Auditd. In order to capture events within containers, we next implemented an event publisher based on eBPF. We discovered what works, what doesn’t, and some paths forward.
  - How osquery uses sqlite3 and rocksdb - Alex Malone(Querycon2019)
    - We will walk through a query from SQL to the logged JSON results, noting the important interactions with sqlite3 and rocksdb. For example, the processes table specifies an INDEX on pid. What does that entail, and how does it impact how the table generate() function is called? In this talk, listeners will gain insight into the sqlite3 virtual table API.
- Tooling
  - Fleet Managers
    - Fleet
      - Fleet is the most widely used open-source osquery Fleet manager. Deploying osquery with Fleet enables live queries, and effective management of osquery infrastructure.
    - Doorman
      - Doorman is an osquery fleet manager that allows administrators to remotely manage the osquery configurations retrieved by nodes. Administrators can dynamically configure the set of packs, queries, and/or file integrity monitoring target paths using tags. Doorman takes advantage of osquery's TLS configuration, logger, and distributed read/write endpoints, to give administrators visibility across a fleet of devices with minimal overhead and intrusiveness.
  - Plugins/Extensions
    - osquery-go
      - This project contains Go bindings for creating osquery extensions in Go.
    - osquery-python
      - This project contains the official Python bindings for creating osquery extensions in Python.
    - brosquery
      - This project builds an OSQuery module libbro.so for loading bro logs as tables in osquery.
    - osquery extensions by Trail of Bits
      - This repository includes osquery extensions developed and maintained by Trail of Bits.
  - Queries
    - Threat Hunting & Incident Investigation with Osquery
      - "The objective of this repo is to share 100+ hunting queries (osquery) that will help cyber threat analysts (hunter/investigator) in their hunting or investigation exercises. Broadly, I have covered persistence, process interrogation, memory analysis, driver profiling, and other misc categories. Persistence and Process Interrogations queries map to the multiple tactics & techniques/sub-techniques of MITRE ATT&CK framework."
IoC-Related
- 101
  - threat-recognition
    - "I attempted to diagram everything I've learned about the problem-set of endpoint threat recognition over the past 2 years of research. (Final Draft)"
- Articles/Blogposts/Writeups
  - Indicator life cycle applied to threat hunting - Joseliyo(2021)
- Papers
  - From TTP to IoC: Advanced Persistent Graphs for Threat Hunting - Aimad Berady, Mathieu Jaume, Valérie Viet Triem Tong, Gilles Guette(2021
    - Defenders fighting against Advanced Persistent Threats need to discover the propagation area of an adversary as quickly as possible. This discovery takes place through a phase of an incident response operation called Threat Hunting, where defenders track down attackers within the compromised network. In this article, we propose a formal model that dissects and abstracts elements of an attack, from both attacker and defender perspectives. This model leads to the construction of two persistent graphs on a common set of objects and components allowing for (1) an omniscient actor to compare, for both defender and attacker, the gap in knowledge and perceptions; (2) the attacker to become aware of the traces left on the targeted network; (3) the defender to improve the quality of Threat Hunting by identifying false-positives and adapting logging policy to be oriented for investigations. In this article, we challenge this model using an attack campaign mimicking APT29, a real-world threat, in a scenario designed by the MITRE Corporation. We measure the quality of the defensive architecture experimentally and then determine the most effective strategy to exploit data collected by the defender in order to extract actionable Cyber Threat Intelligence, and finally unveil the attacker.
- 'Dumb' Binary Analysis
  - Typos and other obscurities that can be found inside Windows binaries - Hexacorn(2020)
  - Sig
    - The most powerful and customizable binary pattern scanner written in modern C++
- File Analysis
  - BinaryAlert
    - BinaryAlert is an open-source serverless AWS pipeline where any file uploaded to an S3 bucket is immediately scanned with a configurable set of YARA rules. An alert will fire as soon as any match is found, giving an incident response team the ability to quickly contain the threat before it spreads.
  - StreamAlert
    - StreamAlert is a serverless, real-time data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using data sources and alerting logic you define. Computer security teams use StreamAlert to scan terabytes of log data every day for incident detection and response.
Yara
- 101
- Articles/Blogposts/Writeups
  - Threat Hunting With Yara Rules - Larosh Khan(2021)

Network-based

Logging
- Articles/Writeups
  - Introducing Network Error Logging - dcreager.net(2018)
  - Improving Packet Capture Performance – 1 of 3 - Bill Stearns(2020)
    - Part 2
    - Part 3
- Talks/Presentations/Videos
  - Collect All the Data - Protect All the Things - Aaron Rosenmund(Derbycon2019)
    - Protecting all the things, all the time requires the collection and analysis of all the data. The range of threats is wide and can be highly advanced. To bring the sexy back to blue team, the next generation security operations team has too look across all the available data sources. Correlating of network, application, machine, and endpoint OS data events to find anomalous behavior and reduce false positives. This talk covers application of different methods of collection and analysis as well as the use of machine learning to generate behavioral anomalies that are incorporated into overall continuous monitoring capabilities to catch a variety of apt activity before a signature has been developed. This is not a vendor talk and nearly all tools discussed are open source and free.
Monitoring
- Articles/Writeups
- Talks/Presentations
  - Passive IPS Reconnaissance and Enumeration - false positive (ab)use - Arron Finnon
    - Network Intrusion Prevention Systems or NIPS have been plagued by "False Positive" issues almost since their first deployment. A "False Positive" could simply be described as incorrectly or mistakenly detecting a threat that is not real. A large amount of research has gone into using "False Positive" as an attack vector either to attack the very validity of an IPS system or to conduct forms of Denial of Service attacks. However the very reaction to a "False Positive" in the first place may very well reveal more detailed information about defences than you might well think.
  - You Pass Butter: Next Level Security Monitoring Through Proactivity
- Flow-Data
  - Talks/Presentations/Videos
    - Go with the Flow: Get Started with Flow Analysis Quickly and Cheaply - Jason Smith(2016
      - Some people love buzzwords. I hate them personally. This is especially true for zazzy terms that describe things people have been doing or dealing with for ages. This talk will focus on setting up a next generation platform that will allow you to take control of big data, and hone your hunting skills at the same time. I'm kidding. Whats old is new again, so we're diving into some network flow data. I'll show you how to set it up quickly (less than 10 minutes) and for free (hardware not included). I'll also be showing you how to get started with analysis using some common and not-so-common situations.
  - Papers
    - Network Profiling Using Flow - (2012
      - This report provides a step-by-step guide for profiling—discovering public-facing assets on a network—using network flow (netflow) data. Netflow data can be used for forensic purposes, for finding malicious activity, and for determining appropriate prioritization settings. The goal of this report is to create a profile to see a potential attacker’s view of an external network. Readers will learn how to choose a data set, find the top assets and services with the most traffic on the network, and profile several services. A cas e study provides an example of the profiling process. The underlying concepts of using netflow data are presented so that readers can apply the approach to other cases. A reader using this repor t to profile a network can expect to end with a list of public-facing assets and the ports on which each is communicating and may also learn other pertinent information, such as external IP addresses, to which the asset is connecting. This report also provides ideas for using, maintaining, and reporting on findings. The appendices include an example profile and scripts for running the commands in the report. The scripts are a summary only and cannot replace reading and understanding this report.
- IDS/IPS Tools
  - Snort
    - Snort
      - A free lightweight network intrusion detection system for UNIX and Windows.
    - Snort FAQ
    - Snort User Manual
    - Snort Documentation
  - Bro/Zeek
    - 101
      - Zeek
        
        Zeek is an open source software platform that provides compact, high-fidelity transaction logs, file content, and fully customized output to analysts, from the smallest home office to the largest, fastest research and commercial networks.
      - Zeek Quick Start Guide
      - Zeek Documentation
      - Try Zeek in your browser!
      - Writing Zeek Scripts
    - Articles/Blogposts
      - Simplifying Bro IDS Log Parsing with ParseBroLogs - Dan Gunter
    - Tools
      - bro-intel-generator
        
        Script for generating Bro intel files from pdf or html reports
      - bro-domain-generation
        
        Detect domain generation algorithms (DGA) with Bro. The module will regularly generate domains by any implemented algorithms and watch for those domains in DNS queries. This script only works with Bro 2.1+.
      - Exfil Framework
        
        The Exfil Framework is a suite of Bro scripts that detect file uploads in TCP connections. The Exfil Framework can detect file uploads in most TCP sessions including sessions that have encrypted payloads (SCP,SFTP,HTTPS).
      - brim
        
        Desktop application to efficiently search large packet captures and Zeek logs.
  - Suricata
    - 101
      - Suricata
        
        Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF).
      - Suricata Documentation
        
        Suricata Quick Start Guide
        
        Suricata Installation Guides for various platforms
        
        Setting up Suricata on a Microtik Router
    - Rulesets
      - Creating
        
        Developing complex Suricata rules with Lua – part 1 - Didier Stevens(2017)
        
        Part 2
      - Repos
        
        suricata-rules
  - Argus
    - Argus
      - Argus is an open source layer 2+ auditing tool (including IP audit) written by Carter Bullard which has been under development for over 10 years.
    - Argus on NSM Wiki
    - Argus FAQ
    - Argus How-To
    - Argus Manual
  - Other
    - Maltrail
      - Maltrail is a malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user defined lists, where trail can be anything from domain name (e.g. zvpprsensinaix.com for Banjori malware), URL (e.g. http://109.162.38.120/harsh02.exe for known malicious executable), IP address (e.g. 185.130.5.231 for known attacker) or HTTP User-Agent header value (e.g. sqlmap for automatic SQL injection and database takeover tool). Also, it uses (optional) advanced heuristic mechanisms that can help in discovery of unknown threats (e.g. new malware).
- IDS/IPS Monitoring Tools
  - Snorby
  - Snorby - Github
    - Snorby is a ruby on rails web application for network security monitoring that interfaces with current popular intrusion detection systems (Snort, Suricata and Sagan). The basic fundamental concepts behind Snorby are simplicity, organization and power. The project goal is to create a free, open source and highly competitive application for network monitoring for both private and enterprise use.
  - Squil
    - Sguil (pronounced sgweel) is built by network security analysts for network security analysts. Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis. The Sguil client is written in tcl/tk and can be run on any operating system that supports tcl/tk (including Linux, * BSD, Solaris, MacOS, and Win32).
    - Squil FAQ
  - Squert
    - Squert is a web application that is used to query and view event data stored in a Sguil database (typically IDS alert data). Squert is a visual tool that attempts to provide additional context to events through the use of metadata, time series representations and weighted and logically grouped result sets. The hope is that these views will prompt questions that otherwise may not have been asked.
    - Slide Deck on Squert
    - Install/setup/etc - Github
- PCAPs
- Sigma
  - Sigma
    - Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others. Sigma is for log files what Snort is for network traffic and YARA is for files.
  - Sigma Specification
  - How to Write Sigma Rules - Florian Roth
  - Sigma - Generic Signatures for Log Events - Thomas Patzke(Hack.lu2017)
    - Log files are a great resource for hunting threats and analysis of incidents. Unfortunately, there is no standardized signature format like YARA for files or Snort signatures for network traffic. This makes sharing of log signatures by security researchers and software developers problematic. Further, most SIEM systems have their own query language, which makes signature distribution in large heterogeneous environments inefficient and increases costs for replacement of SIEM solutions.Sigma tries to fill these gaps by providing a YAML-based format for log signatures, an open repository of signatures and an extensible tool that converts Sigma signatures into different query languages. Rules and tools were released as open source and are actively developed. This presentation gives an overview about use cases, Sigma rules and the conversion tool, the development community and future plans of the project.
  - MITRE ATT&CK and Sigma Alerting - Justin Henderson, John Hubbard(2019)
    - This webcast will introduce the Sigma Alert project and show examples of creating alert rules against MITRE ATT&CK framework items to discover attacks in a way that works for multiple products. Sigma allows for writing rules in a neutral rule format that supports converting the rule to support your product of choice.
- Traffic Analysis
  - Behavioral Analysis using DNS, Network Traffic and Logs, Josh Pyorre (@joshpyorre)
    - Multiple methods exist for detecting malicious activity in a network, including intrusion detection, anti-virus, and log analysis. However, the majority of these use signatures, looking for already known events and they typically require some level of human intervention and maintenance. Using behavioral analysis methods, it may be possible to observe and create a baseline of average behavior on a network, enabling intelligent notification of anomalous activity. This talk will demonstrate methods of performing this activity in different environments. Attendees will learn new methods which they can apply to further monitor and secure their networks
  - DNS
    - Network Forensics with Windows DNS Analytical Logging
  - SMB
    - An Introduction to SMB for Network Security Analysts - 401trg
  - TLS
    - TLS client fingerprinting with Bro
    - Talk/Presentation
      - In this talk we will show the benefits of SSL fingerprinting, JA3’s capabilities, and how best to utilize it in your detection and response operations. We will show how to utilize JA3 to find and detect SSL malware on your network. Imagine detecting every Meterpreter shell, regardless of C2 and without the need for SSL interception. We will also announce JA3S, JA3 for SSL server fingerprinting. Imagine detecting every Metasploit Multi Handler or [REDACTED] C2s on AWS. Then we’ll tie it all together, making you armed to the teeth for detecting all things SSL.
  - Tools
    - RITA - Real Intelligence Threat Analytics
      - RITA is an open source network traffic analysis framework.
      - RITA - Finding Bad Things on Your Network Using Free and Open Source Tools
    - General
      - DNSpop
        
        Tools to find popular trends by analysis of DNS data. For more information, see my blog post on the most popular subdomains on the internet. Hit the results directory to get straight to the data.
      - Yeti
        
        Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository. Yeti will also automatically enrich observables (e.g. resolve domains, geolocate IPs) so that you don't have to. Yeti provides an interface for humans (shiny Bootstrap-based UI) and one for machines (web API) so that your other tools can talk nicely to it.
      - Malcom - Malware Communication Analyzer
        
        Malcom is a tool designed to analyze a system's network communication using graphical representations of network traffic, and cross-reference them with known malware sources. This comes handy when analyzing how certain malware species try to communicate with the outside world.
      - BeaconBits
        
        Beacon Bits is comprised of analytical scripts combined with a custom database that evaluate flow traffic for statistical uniformity over a given period of time. The tool relies on some of the most common characteristics of infected host persisting in connection attempts to establish a connection, either to a remote host or set of host over a TCP network connection. Useful to also identify automation, host behavior that is not driven by humans.
- General Tools
  - General
    - Security Onion
      - Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It's based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert, Snorby, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
  - Bandwidth
    - bmon - bandwidth monitor and rate estimator
      - bmon is a monitoring and debugging tool to capture networking related statistics and prepare them visually in a human friendly way. It features various output methods including an interactive curses user interface and a programmable text output for scripting.
  - Data Tranformation
    - Pip3line, the Swiss army knife of byte manipulation
      - Pip3line is a raw bytes manipulation utility, able to apply well known and less well known transformations from anywhere to anywhere (almost).
    - dnstwist
      - Domain name permutation engine for detecting typo squatting, phishing and corporate espionage
  - DNS
    - DNSChef
      - DNSChef is a highly configurable DNS proxy for Penetration Testers and Malware Analysts. A DNS proxy (aka "Fake DNS") is a tool used for application network traffic analysis among other uses. For example, a DNS proxy can be used to fake requests for "badguy.com" to point to a local machine for termination or interception instead of a real host somewhere on the Internet.
    - Passive DNS
      - A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring (NSM) and general digital forensics. * PassiveDNS sniffs traffic from an interface or reads a pcap-file and outputs the DNS-server answers to a log file. PassiveDNS can cache/aggregate duplicate DNS answers in-memory, limiting the amount of data in the logfile without losing the essense in the DNS answer.
  - HTTP Traffic
    - Captipper
      - CapTipper is a python tool to analyze, explore and revive HTTP malicious traffic. CapTipper sets up a web server that acts exactly as the server in the PCAP file, and contains internal tools, with a powerful interactive console, for analysis and inspection of the hosts, objects and conversations found.
  - PCAPs/Packet Capture
    - CapLoader
      - CapLoader is a Windows tool designed to handle large amounts of captured network traffic. CapLoader performs indexing of PCAP/PcapNG files and visualizes their contents as a list of TCP and UDP flows. Users can select the flows of interest and quickly filter out those packets from the loaded PCAP files. Sending the selected flows/packets to a packet analyzer tool like Wireshark or NetworkMiner is then just a mouse click away.
    - Netdude
      - The Network Dump data Displayer and Editor is a framework for inspection, analysis and manipulation of tcpdump trace files. It addresses the need for a toolset that allows easy inspection, modification, and creation of pcap/tcpdump trace files. Netdude builds on any popular UNIX-like OS, such as Linux, the BSDs, or OSX.
    - Stenographer
      - Stenographer is a full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files as disk fills up, and provides methods for reading back specific sets of packets quickly and easily.
    - PCAPDB
      - PcapDB is a distributed, search-optimized open source packet capture system. It was designed to replace expensive, commercial appliances with off-the-shelf hardware and a free, easy to manage software system. Captured packets are reorganized during capture by flow (an indefinite length sequence of packets with the same src/dst ips/ports and transport proto), indexed by flow, and searched (again) by flow. The indexes for the captured packets are relatively tiny (typically less than 1% the size of the captured data).
    - Network Miner
      - NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD). NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.
    - SilLK
      - Silk
        
        The SiLK analysis suite is a collection of command-line tools for processing SiLK Flow records created by the SiLK packing system. These tools read binary files containing SiLK Flow records and partition, sort, and count these records. The most important analysis tool is rwfilter, an application for querying the central data repository for SiLK Flow records that satisfy a set of filtering options. The tools are intended to be combined in various ways to perform an analysis task. A typical analysis uses UNIX pipes and intermediate data files to share data between invocations of the tools.
      - Administering/Installing SiLK
      - SiLK Tool Tips
      - SiLK Reference Guide
      - SiLK Toolsuite Quick Reference Guide
      - flowbat
        
        Awesome flow tool, SiLK backend
  - ShellCode Analysis
    - Shellcode Analysis Pipeline
      - I recently required an automated way of analyzing shellcode and verifying if it is detected by Libemu, Snort, Suricata, Bro, etc. Shellcode had to come from public sources like Shell-Storm, Exploit-DB and Metasploit. I needed an automated way of sourcing shellcode from these projects and pass it on to the analysis engines in a pipeline-like mechanism. This posts documents the method I used to complete this task and the overall progress of the project.
Detection Engineering
- FYI
  - looking for JARM/JA3/Etc? Look at the section below, I've broken things out by protocol
- Tools
  - Recog: A Recognition Framework
    - Recog is a framework for identifying products, services, operating systems, and hardware by matching fingerprints against data returned from various network probes. Recog makes it simple to extract useful information from web server banners, snmp system description fields, and a whole lot more.
- Papers * A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems - Hanan Hindy, David Brosset, Ethan Bayne, Amar Kumar Seeam, Christos Tachtatzis, Robert Atkinson, Xavier Bellekens(2020) * As the world moves towards being increasingly dependent on computers and automation, building secure applications, systems and networks are some of the main challenges faced in the current decade. The number of threats that individuals and businesses face is rising exponentially due to the increasing complexity of networks and services of modern networks. To alleviate the impact of these threats, researchers have proposed numerous solutions for anomaly detection; however, current tools often fail to adapt to ever-changing architectures, associated threats and zero-day attacks. This manuscript aims to pinpoint research gaps and shortcomings of current datasets, their impact on building Network Intrusion Detection Systems (NIDS) and the growing number of sophisticated threats. To this end, this manuscript provides researchers with two key pieces of information; a survey of prominent datasets, analyzing their use and impact on the development of the past decade's Intrusion Detection Systems (IDS) and a taxonomy of network threats and associated tools to carry out these attacks. The manuscript highlights that current IDS research covers only 33.3% of our threat taxonomy. Current datasets demonstrate a clear lack of real-network threats, attack representation and include a large number of deprecated threats, which together limit the detection accuracy of current machine learning IDS approaches. The unique combination of the taxonomy and the analysis of the datasets provided in this manuscript aims to improve the creation of datasets and the collection of real-world data. As a result, this will improve the efficiency of the next generation IDS and reflect network threats more accurately within new datasets.
Threat Hunting
- 101
  - Awesome Network Analysis
    - A curated list of awesome network analysis resources.
- Articles/Writeups
- Talks & Presentations
  - Top 8 Things to Analyze in When Monitoring Outgoing Connections to Detect Compromised System - Randy Franklin
    - In this webinar, Randy Franklin Smith of Ultimate Windows Security, discusses the Top 8 Things to Analyze while monitoring outgoing connections from your network to the Internet: Reputation of destination IPs and domains; DNS queries from clients on your network; Suspect traffic patterns; Unrecognized protocols; Masquerading protocols; Known signatures; Prohibited protocols; DLP indicators
  - Tales from the Network Threat Hunting Trenches - BHIS
    - In this webcast John walks through a couple of cool things we’ve found useful in some recent network hunt teams. He also shares some of our techniques and tools (like RITA) that we use all the time to work through massive amounts of data. There are lots of awesome websites that can greatly increase the effectiveness of your in network threat hunting.
  - Network gravity: Exploiring a enterprise network - Casey Martin(BSides Tampa2020)
    - Enterprise networks are often complex, hard to understand, and worst of all - undocumented. Few organizations have network diagrams and asset management systems and even fewer organizations have those that are effective and up to date. Leveraging an organization's SIEM or logging solution, network diagrams and asset inventories can be extrapolated from this data through the 'gravity' of the network. Similar to our solar system and galaxy, even if you cannot confirm or physically see an object, you can measure the forces of gravity it exerts on the observable objects around it that we do know about. For example, unconfirmed endpoints can be enumerated by the authentication activity they register on known domain controllers. The inferred list of endpoints and their network addresses can begin to map out logical networks. The unpolished list of logical networks can be mapped against known egress points to identify physical networks and potentially identify undiscovered egress points and the technologies that exist at the egress points. As more objects are extrapolated and inferred, the more accurate the model of your enterprise network will become. Through this iterative and repeatable process, network diagrams and asset inventories can be drafted, further explored, refined, and ultimately managed. Even the weakest of observable forces can create fingerprints that security professionals can leverage to more effectively become guardians of the galaxy.
- Papers
  - HeadPrint: Detecting Anomalous Communications through Header-based Application Fingerprinting - Riccardo Bortolameotti, Thijs van Ede, Andrea Continella, Thomas Hupperich, Maarten H. Everts, Reza Rafati, Willem Jonker, Pieter Hartel, Andreas Peter(2020)
  - Under the Shadow of Sunshine: Understanding and Detecting Bulletproof Hosting on Legitimate Service Provider Networks - Sumayah Alrwais, Xiaojing Liao, Xianghang Mi, Peng Wang, XiaoFeng Wang, Feng Qian, Raheem Beyah, Damon McCoy
    - In this paper, we present the first systematic study on thisnew trend of BPH services. By collecting and analyzing a large amount of data (25 Whois snapshots of the entire IPv4 addressspace, 1.5 TB of passive DNS data, and longitudinal data fromseveral blacklist feeds), we are able to identify a set of newfeatures that uniquely characterizes BPH on sub-allocations and are costly to evade. Based upon these features, we train a classifierfor detecting malicious sub-allocated network blocks, achieving a 98% recall and 1.5% false discovery rates according to our evaluation. Using a conservatively trained version of our classifier,we scan the whole IPv4 address space and detect 39K malicious network blocks. This allows us to perform a large-scale study ofthe BPH service ecosystem, which sheds light on this underground business strategy, including patterns of network blocks being recycled and malicious clients migrating to different network blocks, in an effort to evade IP address based blacklisting. Our study highlights the trend of agile BPH services and points to potential methods of detecting and mitigating this emerging threat.
- Protocol Agnostic
  - Articles/Writeups
    - PCAP Command-Line Madness! - Hal Pomeranz()
  - Tools
    - fatt
      - A script for extracting network metadata and fingerprints such as JA3 and HASSH from packet capture files (pcap) or live network traffic. The main use-case is for monitoring honeypots, but you can also use it for other use cases such as network forensic analysis. fatt works on Linux, macOS and Windows.
    - BruteShark
      - BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files, but it also capable of directly live capturing from a network interface). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords and even convert them to a Hashcat format in order to perform an offline Brute Force attack.
- DNS
  - Articles/Writeups
  - Talks/Presentations/Videos
    - DoH! DNS over HTTPS: for Attackers and Defenders - Marcus W Tonsmann(WWHF2020)
      - DoH is coming. This talk will prepare you by covering the basics of the protocol, available tools for testers, and techniques being leveraged by real adversaries. Proactive defensive measures will also be discussed, with an eye towards the future.
- HTTP/S
  - Articles/Writeups
  - Talks/Presentations/Videos
  - Tools
- OS Fingerprinting
  - Articles/Writeups
    - Derevolutionizing OS Fingerprinting cat and mouse game - Jaime Sanchez(DEFCON27 Recon Village)
  - Talks/Presentations/Videos
  - Tools
    - Neighbor Cache Fingerprinter
      - This tool provides a mechanism for remote operating system detection by extrapolating characteristics of the target system's underlying Neighbor Cache and general ARP behavior. Given the non-existence of any standard specification for how the Neighbor Cache should behave, there several differences in operating system network stack implementations that can be used for unique identification.
    - OSfooler-ng
      - OSfooler-ng prevents remote active/passive OS fingerprinting by tools like nmap or p0f
- QUIC
  - Articles/Writeups
    - GQUIC Protocol Analysis and Fingerprinting in Zeek - Caleb Yu(2022)
  - Talks/Presentations/Videos
  - Tools
    - GQUIC Protocol Analyzer
      - GQUIC Protocol Analyzer for Zeek (Bro) Network Security Monitor
- RDP
  - Articles/Writeups
    - RDP Fingerprinting - Adel Ka(2019)
  - Talks/Presentations/Videos
    - Seeing the Invisible: Finding Fingerprints on Encrypted Traffic - Adel Karimi(KawaiiCon2019)
      - Slides
  - Tools
- SSH
  - Articles/Writeups
    - Open Sourcing HASSH - Ben Reardon(2018)
  - Talks/Presentations/Videos
    - "SSH, so hot right now. Profiling it with HASSH" - Ben Reardon & Adel Karimi(BSides Canberra(2019)
      - Slides
    - HASSH - a Profiling Method for SSH Clients and Servers - Ben Reardon(ACoD2019)
      - Slides
  - Tools
    - HASSH
      - "HASSH" is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint.
    - hassh-utils
      - Nmap NSE Script and Docker image for HASSH - the SSH client/server fingerprinting method
- TLS
  - Articles/Writeups
    - TLS fingerprinting: Smarter Defending & Stealthier Attacking - SquareLemon(2015)
    - TLS Fingerprinting with JA3 and JA3S - John Althouse
    - Easily Identify Malicious Servers on the Internet with JARM - John Althouse(2021)
    - Effective TLS Fingerprinting Beyond JA3 - ntop.org
    - Hunting Koadic Pt. 2 - JARM Fingerprinting - Pat H(2020)
    - TLS Fingerprint
      - "We collect anonymized TLS Client Hello messages from the University of Colorado Boulder campus network, in order to measure the popularity of various implementations actually used in practice."
    - TLS Fingerprinting in the Real World - Blake Anderson(2019)
  - Talks/Presentations/Videos
  - Papers
    - HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting - Martin Husák1, Milan Čermák1, Tomáš Jirsík1, Pavel Čeleda(2016)
      - "The encryption of network traffic complicates legitimate network monitoring, traffic analysis, and network forensics. In this paper, we present real-time lightweight identification of HTTPS clients based on network monitoring and SSL/TLS fingerprinting. Our experiment shows that it is possible to estimate the User-Agent of a client in HTTPS communication via the analysis of the SSL/TLS handshake. The fingerprints of SSL/TLS handshakes, including a list of supported cipher suites, differ among clients and correlate to User-Agent values from a HTTP header. We built up a dictionary of SSL/TLS cipher suite lists and HTTP User-Agents and assigned the User-Agents to the observed SSL/TLS connections to identify communicating clients. The dictionary was used to classify live HTTPS network traffic. We were able to retrieve client types from 95.4 % of HTTPS network traffic. Further, we discussed host-based and network-based methods of dictionary retrieval and estimated the quality of the data."
    - The use of TLS in Censorship Circumvention - Sergey Frolov, Eric Wustrow(2019)
      - In this paper, we collect and analyze real-world TLS traffic from over 11.8 billion TLS connections over 9 months to identify a wide range of TLS client implementations actually used on the Internet. We use our data to analyze TLS implementations of several popular censorship circumvention tools, including Lantern, Psiphon, Signal, Outline, TapDance, and Tor (Snowflake and meek pluggable transports). We find that the many of these tools use TLS configurations that are easily distinguishable from the real-world traffic they attempt to mimic, even when these tools have put effort into parroting popular TLS implementations. To address this problem, we have developed a library, uTLS, that enables tool maintainers to automatically mimic other pop- ular TLS implementations. Using our real-world traffic dataset, we observe many popular TLS implementations we are able to correctly mimic with uTLS, and we describe ways our tool can more flexibly adapt to the dynamic TLS ecosystem with minimal manual effort.
    - TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior - Blake Anderson, David McGrew(2019)
      - To understand in detail what applications are using TLS, and how they are using it, we developed a novel system for obtaining process information from end hosts and fusing it with network data to produce a TLS fingerprint knowledge base. This data has a rich set of context for each fingerprint, is representative of enterprise TLS deployments, and is automatically updated from ongoing data collection. Our dataset is based on 471 million endpoint-labeled and 8 billion unlabeled TLS sessions obtained from enterprise edge networks in five countries, plus millions of sessions from a malware analysis sandbox. We actively maintain an open source dataset that, at 4,500+ fingerprints and counting, is both the largest and most informative ever published. In this paper, we use the knowledge base to identify trends in enterprise TLS applications beyond the browser: application categories such as storage, communication, system, and email. We identify a rise in the use of TLS by non- browser applications and a corresponding decline in the fraction of sessions using version 1.3. Finally, we highlight the shortcomings of naïvely applying TLS fingerprinting to detect malware, and we present recent trends in malware’s use of TLS such as the adoption of cipher suite randomization.
    - Markov Chain Fingerprinting to Classify Encrypted Traffic - Maciej Korczynski, Andrzej Duda(
      - "In this paper, we propose stochastic fingerprints for application traffic flows conveyed in Secure Socket Layer/Transport Layer Security (SSL/TLS) sessions. The fin- gerprints are based on first-order homogeneous Markov chains for which we identify the parameters from observed training application traces. As the fingerprint parameters of chosen applications considerably differ, the method results in a very good accuracy of application discrimination and provides a possibility of detecting abnormal SSL/TLS sessions. Our analysis of the results reveals that obtaining application discrimination mainly comes from incorrect implementation practice, the misuse of the SSL/TLS protocol, various server configurations, and the application nature."
  - Tools
    - JA3 - A method for profiling SSL/TLS Clients
      - JA3 is a method for creating SSL/TLS client fingerprints that are easy to produce and can be easily shared for threat intelligence.
    - JA3 SSL Fingerprint DB
    - JARM
      - JARM is an active Transport Layer Security (TLS) server fingerprinting tool.
- Hunting Beacons/C2 Traffic
  - 101
    - Coefficient of variation - Wikipedia
      - "In probability theory and statistics, the coefficient of variation (CV), also known as relative standard deviation (RSD), is a standardized measure of dispersion of a probability distribution or frequency distribution. It is often expressed as a percentage, and is defined as the ratio of the standard deviation <snip>to the mean<snip>."
  - Articles/Blogposts/Writeups
  - Talks/Presentations/Videos
    - Threat Hunting Beacon Analysis - Chris Brenton(2018)
      - Join Chris Brenton, COO of Active Countermeasures, as he discusses the anatomy of beacons and why you need to be looking for them during a threat hunt. He also talks through the challenges of detecting beacons, and some tricks you can use.
- Tools
  - beacon-fronting
    - A simple command line program to help network defenders test their detections for network beacon patterns and domain fronting
  - Imaginary C2
    - A python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to replay captured Command-and-Control responses/served payloads.

Linux-based

Logging
- Articles/Writeups
  - 21 Critical Linux Log Files (Server & Network Monitoring) - Charles Joseph()
- Talks/Presentations/Videos
- Tools
  - Audit Record Types - RHEL Audit System Reference
    - "The following table lists all currently-supported types of Audit records. The event type is specified in the type= field at the beginning of every Audit record."
  - LAUREL - Linux Audit – Usable, Robust, Easy Logging
    - LAUREL is an event post-processing plugin for auditd(8) to improve its usability in modern security monitoring setups.
  - LNAV -- The Logfile Navigator
    - The Log File Navigator, lnav for short, is an advanced log file viewer for the small-scale. It is a terminal application that can understand your log files and make it easy for you to find problems with little to no setup.
  - Syslong-ng
    - syslog-ng is an enhanced log daemon, supporting a wide range of input and output methods: syslog, unstructured text, message queues, databases (SQL and NoSQL alike) and more.
Monitoring
- Articles/Writeups
  - Different Approaches to Linux Monitoring - Kelly Shortridge
- Talks/Presentations/Videos
  - Linux Performance Analysis: New Tools and Old Secrets - Brendan Gregg(USENIX Lisa2014)
    - Slides
  - Seccomp for developers making your applications more secure - Alexander Reelsen(BSidesSG2020)
    - Application developers tend to focus on features first with security being an afterthought to those features. Instead of rolling your own security, this talk will show how to integrate seccomp into your self written applications. We will take a look at the different possibilities of how to add a seccomp policy to your application. We will also take a look at different programming languages to show, that it is easy in many programming languages to add this kind of feature. Lastly, we will also show how to monitor and detect seccomp violations using Elasticsearch, Kibana and auditbeat. The goal of this talk is make sure that any developer in the room does absolutely have zero excuses to not use seccomp to secure their application.
- AuditD & SELinux
  - 101
  - Articles/Writeups
  - Tools
    - AuditD - Neo23x0
      - Best Practice Auditd Configuration
    - go-audit
      - go-audit is an alternative to the auditd daemon that ships with many distros.
    - auditd-attack
      - A Linux Auditd rule set mapped to MITRE's Attack Framework
- eBPF
  - 101
    - ebpf.io
      - eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules.
  - Articles/Writeups
  - Tools
    - ebpfpub
      - ebpfpub is a generic function tracing library for Linux that supports tracepoints, kprobes and uprobes.
    - RedBPF
      - A Rust eBPF toolchain.
- Processes
  - Articles/Writeups
    - The Difficulties of Tracking Running Processes on Linux - Natan Yellin(2020)
    - Using the Linux Audit API to Track Processes - Natan Yellin(2020)
- Syscalls
  - Articles/Writeups
    - Logging root actions by capturing execve system calls - Michael Boelen(2015)
    - Monitoring linux system-calls the right way - Matteo Malvica(2019)
    - Detecting Kernel Hooking using eBPF - Pat H(2021)
      - tl/dr: I demonstrate an example project that uses eBPF and stack traces to detect syscall-hooking kernel rootkits. Maybe?
  - Tools
    - ProcMon-for-Linux
      - Procmon is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system.
- System Monitoring
  - Tools
    - SysMonTask
      - Linux system monitor with the compactness and usefulness of Windows Task Manager to allow higher control and monitoring.
    - perf-tools
    - bpytop
      - Resource monitor that shows usage and stats for processor, memory, disks, network and processes.
- Sysmon(For Linux)
  - 101
    - SysmonForLinux
  - Articles/Writeups
Detection Engineering
- File Access
  - Articles/Blogposts/Writeups
    - Everything’s a file: Securing the Linux VFS - Dave Bogle(2022)
  - Tools
    - whatfiles
      - Whatfiles is a Linux utility that logs what files another program reads/writes/creates/deletes on your system. It traces any new processes and threads that are created by the targeted process as well.
- Kubernetes
  - Articles/Blogposts/Writeups
    - Detection Engineering for Kubernetes clusters - Ben Lister(2021)
      - "This blog post details the collaboration between NCC Group’s Detection Engineering team and our Containerisation team in tackling detection engineering for Kubernetes. Additionally, it describes the Detection Engineering team’s more generic methodology around detection engineering for new/emerging technologies and how it was used when developing detections for Kubernetes-based attacks."
- Network
  - Tools
    - snuffy
      - Snuffy is a simple command line tool to inspect SSL/TLS connections. It currently supports OpenSSL and NSS.
- Processes
  - Articles/Blogposts/Writeups
    - Life and Death of a Linux Process - Natan Yellin(2020)
    - The Linux process and session model as part of security alerting and monitoring - Mike Sample(2022)
  - Tools
    - IPCDump
      - ipcdump is a tool for tracing interprocess communication (IPC) on Linux. It covers most of the common IPC mechanisms -- pipes, fifos, signals, unix sockets, loopback-based networking, and pseudoterminals. It's a useful tool for debugging multi-process applications, and it's also a simple way to understand how the different moving parts in your system communicate with one another. ipcdump can trace both the metadata and the contents of this communication, and it's particularly well-suited to tracing IPC between short-lived processes, which can be difficult using traditional debugging tools, like strace or gdb. It also has some basic filtering capabilities to help you sift through large quantities of events. Most of the information ipcdump collects comes from BPF hooks placed on kprobes and tracepoints at key functions in the kernel, although it also fills in some bookkeeping from the /proc filesystem. To this end ipcdump makes heavy use of gobpf, which provides golang binding for the bcc framework.
- Shell
  - Articles/Blogposts/Writeups
    - Using eBPF to uncover in-memory loading - pat_h/to/file(2021)
    - BPF-PipeSnoop
      - Example program using eBPF to log data being based in using shell pipes (|)
Threat Hunting
- Talks/Presentations/Videos
  - Hunting Malware on Linux Production Servers: The Windigo Backstory - Olivier Bilodeau(Derbycon2014)
    - "Operation Windigo is a large server,side malware campaign that targets Unix systems (BSD, Linux, etc.). There are three major components: Linux/Ebury an OpenSSH backdoor and credential stealer, Linux/Cdorked a Web Server backdoor (it works with Apache, Nginx, Lighttpd) that redirects end,users to exploit kits, and Perl/Calfbot a spam sending daemon. The malicious operators control more than 25 000 compromised servers. Every day, they use this infrastructure to redirect more than 500 000 end,users to malicious content and send more than 35M spam messages.This talk will cover what we have done in order to investigate this operation. How we lured the operators into systems we own and observed them. The tools we have built and techniques we have used in order to eavesdrop their SSH and C&C SSL traffic and gather more information about the threats.We will also cover what we have found: the level of professionalism of the malicious actors. They are skilled and stealthy. We will cover their use of elaborate deployments scripts that checks for undocumented backdoors, disable security configuration and get a sense of how risky for them the server under attack is. We will also look at their various network evasion techniques and their use of non,persistent malware and proxies. Attend our talk to understand how traditional on,disk forensic isn’t sufficient to detect and investigate these types of threats. Learn to react to them by doing live system forensic with standard Linux utilities. As a bonus you will get an epic story of a year,long research on a malware battle happening on Internet,facing servers. "
- Hunting Privilege Escalation
  - Detecting MITRE ATT&CK: Privilege escalation with Falco - Stefano Chierici(2021)
- Kubernetes
  - Articles/Blogposts/Writeups
    - Threat Hunting with Kubernetes Audit Logs - Ramesh Ramani(2021)
      - Part 2
- OS Fingerprinting
  - Talks/Presentations/Videos
    - Derevolutionizing OS Fingerprinting cat and mouse game - Jaime Sanchez(Defcon27 ReconVillage)
- Persistence
  - Articles/Blogposts/Writeups
- Privilege Escalation
  - Articles/Blogposts/Writeups
- SSH
  - Decrypting OpenSSH sessions for fun and profit - Jelle Verger(2020)
- Linux Sysmon
  - SysmonLinux.Util
    - PowerShell Module for parsing logs generated by Sysinternals Sysmon for Linux. The module can parse one or more Syslog files from a Linux system and allow for the search of specific events that meet a given criteria. The module can be use also for aiding in the generation of filter rules based on the resulting objects of queries performed against the logs, greatly speeding the creation and tunning of Sysmon configuration files.

Cloud-based

AWS
- Logging
  - 101
- Monitoring
- Detection Engineering
- Threat Hunting
  - Quick and Dirty CloudTrail Threat Hunting Log Analysis - George Fekkas(2021)
  - Talks/Presentations/Videos
    - Actionable threat hunting in AWS (SEC339) - Chris Farris, Suman Koduri(AWS re:Invent 2019)
      - Learn how WarnerMedia leveraged Amazon GuardDuty, AWS CloudTrail, and its own serverless inventory tool (Antiope) to root out cloud vulnerabilities, insecure behavior, and potential account compromise activities across a large number of accounts. We cover how WarnerMedia centralizes and automates its security tooling, offer detailed Splunk queries for GuardDuty and CloudTrail, and discuss how Antiope is used for vulnerability hunting. We cover the scaling issues incurred during a large enterprise merger. Leave this session with a strategy and an actionable set of detections for finding potential data breaches and account compromises.
      - Blogpost
Azure
- Logging
  - 101
- Monitoring
- Detection Engineering
- Threat Hunting

macOS-based

Logging
- 101
  - Logging - developer.apple
  - How long does your Mac keep its log for? - hoakley(2020)
    - "macOS keeps around 52 tracev3 log files in /var/db/diagnostics/Persist, so the active log extends back as long as it has taken to write those"
  - Capturing the moment in your log: how to identify a problem - hoakley(2019)
  - Making your own logarchive from a backup - hoakley
  - Creating Privacy Preferences Policy Control profiles for macOS - rtrouton(2018)
- Understanding
  - Articles/Blogposts/Writeups
- Unified Log
  - 101
    - Logging(macOS) - developer.apple
    - Unified Logging and Activity Tracing - WWDC2016
      - "The new Unified Logging and Tracing System for iOS and macOS uses Activity Tracing for performance, consolidates kernel and user-space logging, and has many other improvements. Learn how Logging and Tracing can help you debug and troubleshoot issues with your apps."
  - Articles/Blogposts/Writeups
  - Talks/Presentations/Videos
    - Unified Logging and Activity Tracing - AppleWWDC2018
      - The new Unified Logging and Tracing System for iOS and macOS uses Activity Tracing for performance, consolidates kernel and user-space logging, and has many other improvements. Learn how Logging and Tracing can help you debug and troubleshoot issues with your apps.
- Endpoint Security Framework
  - Articles/Blogposts/Writeups
    - Taking The macOS Endpoint Security Framework For A Quick Spin - Cedric Owens
- OpenBSM
  - Articles/Blogposts/Writeups
  - Talks/Videos/Presentations
    - Getting Cozy With OpenBSM Auditing On MacOS - Patrick Wardle(Shmoocon2018)
      - Slides
    - Getting Cozy With OpenBSM Auditing On MacOS - Patrick Wardle
      - With the demise of dtrace on macOS, and Apple’s push to rid the kernel of 3rd-party kexts, another option is needed to perform effective auditing on macOS. Lucky for us, OpenBSM fits the bill. Though quite powerful, this auditing mechanism is rather poorly documented and suffered from a variety of kernel vulnerabilities. In this talk, we’ll begin with an introductory overview of OpenBSM’s goals, capabilities, and components before going ‘behind-the-scenes’ to take a closer look at it’s kernel-mode implementation. Armed with this understanding, we’ll then detail exactly how to build powerful user-mode macOS monitoring utilities such as file, process, and networking monitors based on the OpenBSM framework and APIs. Next we’ll don our hacker hats and discuss a handful of kernel bugs discovered during a previous audit of the audit subsystem (yes, quite meta): a subtle off-by-one read error, a blotched patch that turned the off-by-one into a kernel info leak, and finally an exploitable heap overflow. Though now patched, the discussion of these bugs provides an interesting ‘case-study’ of finding and exploiting several types of bugs that lurked within the macOS kernel for many years
- Process Creation
  - Monitoring Process Creation via the Kernel (Part I) - Patrick Wardle(2015)
  - Monitoring Process Creation via the Kernel (Part II) - Patrick Wardle(2015)
- Tools
  - T2M2, Ulbow, Consolation and log utilities - hoakley
    - Investigating a crash using Consolation 3 - hoakley(2019)
  - UnifiedLogReader
    - A parser for Unified logging tracev3 files
  - OSXMon
    - Small project demonstrating log collection using SUpraudit + splunk
  - SUpraudit
    - RE'd praudit rewrite by Jonathan Levin
Monitoring
- Articles/Writeups
  - Monitoring macOS, Part I: Monitoring Process Execution via MACF - Kai Lu
    - Part II: Monitoring File System Events and Dylib Loading via MACF - Kai Lu
    - Part III: Monitoring Network Activities Using Socket Filters - Kai Lu
  - Writing a Process Monitor with Apple's Endpoint Security Framework - Patrick Wardle
- Talks/Presentations/Videos
  - MacOS host monitoring - the open source way - Michael George(Derbycon2017)
    - MacOS host monitoring - the open source way, I will talk about a example piece of malware(Handbrake/Proton) and how you can use open source tooling detection tooling to do detection and light forensics. Since I will be talking about the handbrake malware, I will also be sharing some of the TTPs the malware used if you want to find this activity in your fleet.
- Understanding
- File System/Files/Folders
  - Articles/Blogposts/Writeups
    - Writing a File Monitor with Apple's Endpoint Security Framework - Patrick Wardle
  - Tooling
    - filemon - An FSEvents client http://newosxbook.com/tools/filemon.html
    - filewatcher(2018)
      - Filewatcher is an auditing and monitoring utility for macOS. It can audit all events from the system auditpipe of macOS and filter them by process or by file
    - FileMonitor
      - A macOS File Monitor (based on Apple's new Endpoint Security Framework)
- Processes
  - Articles/Blogposts/Writeups
    - Writing a Process Monitor with Apple's Endpoint Security Framework - Patrick Wardle(2019)
  - Tooling
    - Process Monitor
      - Process Monitor Library (based on Apple's new Endpoint Security Framework)
    - ProcInfo
      - Proc Info is a open-source, user-mode, library for macOS. It provides simple interface to retrieve detailed information about running processes, plus allows one to asynchronously monitor process creation & exit events.
- Sysdiagnose
  - Mac OS X Sysdiagnose – Advanced Mac Troubleshooting Diagnostics - becomethesolution.com
  - sysdiagnose(1) [osx man page]
  - sysdiag-who? - Harry Senior(2020)
    - sysdiagnose is a utility on most macOS and iOS devices that can be used to gather system-wide diagnostic information. Currently on version 3.0, sysdiagnose collects a large amount of data from a wide array of locations on the system. This blog post will seek to outline the immediate value of the data collected by sysdiagnose for the purpose of an investigation.
- Tools
  - Crescendo
    - Crescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.
    - Blogpost
  - Learn How to Build Your Own Utility to Monitor Malicious Behaviors of Malware on macOS - Kai Lu(BH USA 2018)
    - Slides
    - Blogpost
  - Sinter
    - Sinter is a 100% user-mode endpoint security agent for macOS 10.15 and above, written in Swift. Sinter uses the user-mode EndpointSecurity API to subscribe to and receive authorization callbacks from the macOS kernel, for a set of security-relevant event types. The current version of Sinter supports allowing/denying process executions; in future versions we intend to support other types of events such as file, socket, and kernel events.
Detection Engineering
- Articles/Blogposts/Writeups
- Talks/Presentations/Videos
  - The Wild World of macOS Installers - Tony Lambert(OBTSv4.0 2021)
    - In this talk, I'll discuss installation methods that multiple threats have used, from suspected APTs to adware and proof-of-concept code. I'll cover package (PKG) installers with pre- and postinstall scripts, application bundles distributed in DMG files, and third-party library installation using tools such as Python's PIP utility. In addition to real-world examples documented in the wild, I'll also show the malware execution using data from endpoint detection and response (EDR) technology to provide ideas for effective analytics.
  - Becoming a Yogi on Mac ATT&CK with OceanLotus Postures - Cat Self, Adam Pennington(OBTSv4.0 2021)
  - Mac Detections by The Numbers - Thomas Reed(OBTSv4.0 2021)
    - Come hear about interesting pieces of Mac malware, and see data relating to their detections. In addition to discovering interesting malware behaviors, you'll learn things like which malware is most common, how malware is distributed globally, and interesting observations about malware artifacts.
  - "Plug-n-Play: Using Native Code with Installer Plugins for Initial Access" - Chris Ross(OBTSv4.0 2021)
    - MacOS initial access techniques are somewhat limited for red teamers. Security features such as Gatekeeper, Notarization, and the application sandbox add more complexity to getting a foothold. Amongst all of the payload types for macOS, installer packages provide the most versatility for code execution techniques. Unfortunately, installer scripts and distribution XML in-line JavaScript code execution techniques leave command line artifacts and aren't ideal for stealthy initial access. However, installer plugins provide a neat way to execute objective-c code. Apple has changed the mechanics of how installer plugins are executed such that the host process for installer plugins is quickly killed after the installer process exits. This presents an interesting dilemma as attackers will need to find a way to extend the life of their malicious code once executed. In this talk, I'll: - Explain how installer plugins work - Demonstrate two different methods for code execution via native APIs on macOS - Explain these techniques and installer plugins stack up against the Endpoint Security Framework - Share the code with my fellow hackers!
- Endpoint Security Framework
  - Taking ESF For A(nother) Spin - Cedric Owens(2022)
- Workshops
- Tooling
  - Swift-Attack
    - Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods. I have included some post exploitation examples using both command line history and on disk binaries (which should be easier for detection) as well as post exploitation examples using API calls only (which will be more difficult for detection). The post exploitation examples included here are not all encompassing. Instead these are just some common examples that I thought would be useful to conduct unit tests around. I plan to continue to add to this project over time with additional unit tests.
Threat Hunting
- 101
  - Capturing the moment in your log: how to identify a problem - hoakley(2019)
  - A Guide to macOS Threat Hunting and Incident Response - Phil Stokes
  - macOS Post Summary - Action Dan(2020)
    - " This post is going to be a collection of my previous individual posts researching macOS security specifics. I realized I did a bunch of these posts over the span of several years and hadn't tagged them all the same, so I wanted to collect them for new readers in a summary of sorts. For those new readers, this is mostly a collection of my 100-level forensics series, my 200-level red team series, and a few one-off posts around the OS. Those two series were essentially month long deep dives where I approached the macOS operating system from different perspectives. Those series had a few years in between them, so some of the information may be dated, but I hope people find this helpful!"
- Articles/Writeups
- Processes
  - The TrueTree Concept - Jaron Bradley
  - Low-Level Process Hunting on macOS - Jaron Bradley(2020)
- System Extensions(Kexts)
  - The kernel and extensions 1: To Mojave - eclecticlight.co(2022)
  - The kernel and extensions 2: Secure Boot - eclecticlight.co(2022)
  - Mac system extensions for threat detection: Part 1 - Will Yu
    - Part 2
    - Part 3
    - In part 1 of this series, we’ll go over some of the frameworks accessible by kernel extensions that provide information about file system, process, and network events. These frameworks include the Mandatory Access Control Framework, the KAuth framework, and the IP/socket filter frameworks. We won't do a deep dive into each one of these frameworks specifically, as there have been many other posts and guides 0 1 2 3 4 regarding how to use these frameworks. Instead, we’ll recap and review each of these frameworks, then in part 2 we’ll cover some valuable tips and tricks we can use inside the kernel extensions framework that will no longer be available in the new SystemExtensions framework starting in macOS 10.15. And finally, in part 3 of the series, we’ll cover the new SystemExtensions framework and the features it provides to third-party developers.
  - The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures - Phil Stokes(2022)
- Talks & Presentations
  - "MacDoored" Bradley, OBTS v1.0
    - Slides
  - When Macs Come Under ATT&CK - Richie Cyrus(OBTSv1.0)
    - This talk will discuss common tactics, techniques and procedures used by attackers on MacOS systems, as well as methods to detect adversary activity. We will take a look at known malware, mapping the techniques utilized to the MITRE ATT&CK framework. Attendees will leave equipped to begin hunting for evil lurking within their MacOS fleet.
  - Comparing apples to Apple - Adam Mathis(Derbycon2018)
    - Many defenders have hard fought experience finding evil on Windows systems, but stare blankly when handed a Mac. You know all the ways PowerShell can own a box, but how about AppleScript? This practical talk will give defenders a primer in finding adversarial activity on macOS using the TTPs they know and love from other platforms as a reference point.
  - When Macs Come Under ATT&CK - Richie Cyrus(Derbycon2018)
  - Investigating Macs at the Speed of Compromise - Tim Crothers(BSides Augusta2019)
  - Grafting Apple Tree’s: Building a useful process tree - Jaron Bradley(ObjectiveByTheSea v3 2020)
  - Hypothesis-driven MacOS Threat Hunting - Plug(Derpcon2020)
    - "MacOS is a popular operating system deployed across many organizations. Few commercial tools exist that provide proper event visibility in MacOS. Often, these tools are expensive and some lack important monitoring features. However, open-source offers a great selection of tools that can be deployed to kick start a MacOS Threat Hunting Program. In this talk, we will simplify threat hunting and present a technique to create a reliable and useful hunt hypothesis. With only a few open-source tools we will provide and guide the audience on a repeatable methodology to hunt for threats in MacOs or any other OS."
  - Post Infection Analysis on macOS Hosts - Cedric Owens(A Conference for Defense/ACoD(2020))
    - This talk covers post infection analysis as well as some simple yet effective detections for macOS hosts in an enterprise. I will discuss different macOS system artifacts that are useful for investigators, how to query these artifacts, common persistence locations, browser history/ data, log data, network information, process information, and other important pieces of information that defenders can leverage to aid during investigations.
- Papers
  - Logs Unite! Forensic Analysis Of Apple Unified Logs - Sarah Edwards(2017)
- Tools
  - Venator
    - Venator is a python tool used to gather data for proactive detection of malicious activity on macOS devices.
    - Blogpost - Richie Cyrus(2019)
    - [Cleaning the Apple Orchard Using Venator to Detect macOS Compromise - Richie Cyrus(BSides Charm 2019)]
      - Various solutions exist to detect malicious activity on macOS. However, they are not intended for enterprise use or involve installation of an agent. This session will introduce and demonstrate how to detect malicious macOS activity using the tool Venator. Venator is a python based macOS tool designed to provide defenders with the data to proactively identify malicious macOS activity at scale.
  - TrueTree
    - TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process tree on macOS that can be built with traditional pids and ppids is less than helpful on macOS due to all the XPC communication at play. The vast majority of processes end up having a parent process of launchd. TrueTree however displays a process tree that is meant to be useful to incident responders, threat hunters, researchers, and everything in between!
    - Blogpost
  - macOS-ATTACK-DATASET
    - JSON DATASET for macOS mapped to MITRE ATT&CK Techniques and Tactics recorded using Elastic Endpoint Security for macOS.
  - tccprofile
  - String_Spy
    - String Spy is a project aimed at improving MacOS defenses. It allows users to constantly monitor all running processes for user-defined strings, and if it detects a process with such a string it will log the PID, process path, and user running the process. It will also (optionally) kill the process. For certain default C2s and other malicious software, this tool can quickly log and stop malicious behavior that normal AV does not recognize, and allows for customization. Right now, String_Spy is set to look for default Mythic payloads, but any IOC string can be used and searched in running processes. This tool is very similar to Yara, but easier to run for end users.
  - SilentKnight, silnite, LockRattler, SystHist & Scrub - eclecticlight.co

Windows-based

Logging
- 101
- General Articles
- Auditing/Audit Events
  - Windows 10 and Windows Server 2016 security auditing and monitoring reference - microsoft.com
    - This reference details most advanced security audit events for Windows 10 and Windows Server 2016.
  - Windows security audit events - ms.com
    - This spreadsheet details the security audit events for Windows.
- Cheat Sheets
- Command Line Auditing
  - Command line process auditing - docs.ms(2017)
  - Microsoft security advisory: Update to improve Windows command-line auditing: February 10, 2015
  - [Audit Process Creation - docs.ms](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn319093(v=ws.11)\)
    - Prior to Win10
  - Command line process auditing - docs.ms(2017)
    - 'Applies To: Windows Server 2016, Windows Server 2012 R2'
  - Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation) - Daniel Bohannon(BHAsia2018)
    - "In this presentation, I will dive deep into cmd[.]exe's multi-faceted obfuscation opportunities beginning with carets, quotes and stdin argument hiding. Next I will extrapolate more complex techniques including FIN7's string removal/replacement concept and two never-before-seen obfuscation and full encoding techniques – all performed entirely in memory by cmd[.]exe. Finally, I will outline three approaches for obfuscating binary names from static and dynamic analysis while highlighting lesser-known cmd[.]exe replacement binaries."
  - Better know a data source: Process command line - Matt Graeber(2022)
- Event Collector
  - Windows event Collector - Setting up source initiated Subscriptions
  - Windows Event Collector(For centralizing windows domain logging with no local agent, windows actually has built-in logging freely available)
- Event Forwarding
  - 101
    - Introduction to Windows Event Forwarding
    - Windows Event Collector - docs.ms
    - Using Windows Event Collector - docs.ms
      - This section lists the topics that explain the tasks that can be accomplished using the Windows Event Collector SDK.
    - Use Windows Event Forwarding to help with intrusion detection - docs.ms
    - Monitoring what matters – Windows Event Forwarding for everyone (even if you already have a SIEM.) - docs.ms(2015)
    - Windows Event Forwarding - Centralized logging for everyone! (Even if you already have centralized logging!) - Jessica Payne(2015)
    - Use Windows Event Forwarding to help with intrusion detection - docs.ms(2019)
      - Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected.
    - Creating Custom Windows Event Forwarding Logs - docs.ms
    - Windows Event Forwarding: The Best Thing You’ve Never Heard Of - Josh Frantz(2018)
    - The essentials of central log collection with WEF and WEC - Thorben Jandling(2021)
  - Articles/Writeups
    - Windows Event Logging and Forwarding - Australian Cybersecurity Center
      - This document has been developed as a guide to the setup and configuration of Windows event logging and forwarding. This advice has been developed to support both the detection and investigation of malicious activity by providing an ideal balance between the collection of important events and management of data volumes. This advice is also designed to complement existing host-based intrusion detection and prevention systems. This document is intended for information technology and information security professionals. It covers the types of events which can be generated and an assessment of their relative value, centralised collection of event logs, the retention of event logs, and recommended Group Policy settings along with implementation notes.
      - Paper - 2019
      - Australian Cyber Security Center's Windows Event Logging repository
    - Windows Event Forwarding Guidance - Palantir
      - Over the past few years, Palantir has a maintained an internal Windows Event Forwarding (WEF) pipeline for generating and centrally collecting logs of forensic and security value from Microsoft Windows hosts. Once these events are collected and indexed, alerting and detection strategies (ADS) can be constructed not only on high-fidelity security events (e.g. log deletion), but also for deviations from normalcy, such as unusual service account access, access to sensitive filesystem or registry locations, or installation of malware persistence. The goal of this project is to provide the necessary building blocks for organizations to rapidly evaluate and deploy WEF to a production environment, and centralize public efforts to improve WEF subscriptions and encourage adoption. While WEF has become more popular in recent years, it is still dramatically underrepresented in the community, and it is our hope that this project may encourage others to adopt it for incident detection and response purposes. We acknowledge the efforts that Microsoft, IAD, and other contributors have made to this space and wish to thank them for providing many of the subscriptions, ideas, and techniques that will be covered in this post.
    - Event-Forwarding-Guidance - NSA
      - Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding.
    - Xpath Event Log Filtering - docs.ms
    - Windows Event Forwarding for Network Defense - Palantir
    - End-Point Log Consolidation with Windows Event Forwarder - Derek Banks(2017)
    - The Windows Event Forwarding Survival Guide - Chris Long(2017)
    - Setting up Windows Event Forwarder Server (WEF) (Domain) Part 1/3 - Pablo Delgado(2017)
      - Setting up Windows Event Forwarder Server (WEF) (Domain) – Sysmon Part 2/3 - Pablo Delgado(2017)
      - Setting up Windows Event Forwarder Server (WEF) (Domain) – GPO Deployment Part 3/3 - Pablo Delgado(2017)
    - How To Set Up Windows Event Log Forwarding In Windows Server 2016 - Jeff Christman(2019)
  - Talks/Presentations/Videos
    - Windows Event Forwarding and Event Collectors In-Depth - Scott Lynch, Justin Henderson(2021)
      - "In this live stream, we'll talk about how to deploy and fine tune Event Forwarding and include some less commonly discussed topics like managing stale Windows Collector registry entries, how to assign computers to multi-Windows Event Collector server deployments, and concepts like using Windows Event Forwarding to support multiple SIEM environments."
  - Custom Logs
    - Introducing Project Sauron - Centralised Storage of Windows Events - Domain Controller Edition - docs.ms(2017)
      - Code
    - Creating Custom Windows Event Forwarding Logs - docs.ms(2016)
  - Filtering/XPath
  - Tools
    - WEFFLES
      - Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
      - Blogpost
    - WindowsEventForwarding
      - A module for working with Windows Event Collector service and maintain Windows Event Forwarding subscriptions.
    - SWELF
      - Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here at https://github.com/ceramicskate0/SWELF/releases/latest.
- Event Log
  - 101
    - Windows Event Log Reference - docs.ms
    - Event Logging Structures - docs.ms
    - Log Everything Right? - Edward Ruprecht
    - EventLogging
      - This repo contains guidance on setting up event logging. This guidance is broken up into sections, Defensive Readiness Condition (DEFCON), and intended to be applied from 5 (lowest) to 1 (highest).
    - Common misconceptions about Windows EventLogs - Joachim Metz(2021)
  - Reference for Logs
    - My Event Log
      - Searchable database of Windows Event log entries.
    - Windows Event Log Encyclopedia - ultimatewindowsecurity.com
    - Windows Event Logging & Collection Guidance - JSCU-NL
      - "This repository offers administrators, analysts and information security professionals hands-on guidance on how to configure Windows Event Logging and centralize the collection using Windows Event Forwarding. The documents included are written as a technical baseline to create visibility into your network by generating and collecting events that are deemed to have detection or forensic value while aiming to keep noise to a minimum. Configurations in this baseline will be complementary to your AV, IDS or EDR deployments. This approach will enable your organization to track down malicious behavior, shorten the investigation time in case of an incident and improve forensic readiness."
    - Logging Made Easy
      - Homepage(NCSC.gov.uk)
      - Logging Made Easy is a self-install tutorial for small organisations to gain a basic level of centralised security logging for Windows clients and provide functionality to detect attacks. It's the coming together of multiple free and open-source software (some which is covered under licences other than Apache V2), where LME helps the reader integrate them together to produce an end-to-end logging capability. We also provide some pre-made configuration files and scripts, although there is the option to do it on your own.
    - Logmira
      - Logmira has been created as a helpful download of Microsoft Windows Domain Group Policy Object settings. This GPO Backup inclues our recommended windows logging settings for all supported versions of MS Windows Server. As opposed to following a list and manualy modifying 100 or so settings, it's way easier to just import it from a backup.
    - Appendix A: Security monitoring recommendations for many audit events - docs.ms
    - YAML config for NSA Events to Monitor List - Hannah Suarez(2022)
    - YAML config for events from the Windows 10 and Windows Server 2016 Security auditing and monitoring reference - Hannah Suarez(2022)
    - YAML config for exploit protection events based on attack surface reduction events - Hannah Suarez(2021)
    - YAML Config Snippet of JPCERT Lateral Movement Events to Monitor (Windows) - Hannah Suarez(2021)
  - Articles/Writeups
    - Event Log Queries Using PowerShell - Dr Scripto(2015)
    - PowerTip: Query Multiple Event Logs at Once - Dr Scripto(2015)
    - Get-EventLog shows wrong maximum size of event logs - Przemyslaw Klys(2018)
    - Use Windows Event Forwarding to help with intrusion detection - docs.ms
    - Windows Event Log Zero 2 Hero Slides
    - Advanced Audit Policy – which GPO corresponds with which Event ID - girl-germs.com
    - Windows Event Logging for Insider Threat Detection - Derrick Spooner(2019)
    - Statistical Analysis of Windows EventLogs with pandas - Dmitrijs Trizna(2020)
    - JPCert Tool Analysis Result Sheet
      - This site summarizes the results of examining logs recorded in Windows upon execution of the 49 tools which are likely to be used by the attacker that has infiltrated a network. The following logs were examined. Note that it was confirmed that traces of tool execution is most likely to be left in event logs. Accordingly, examination of event logs is the main focus here.
  - Understanding
    - EVTX and Windows Event Logging - Brandon Charter(2008)
      - This paper will explore Microsoft’s EVTX log format and Windows Event Logging framework.
    - Event Log File Format - docs.ms
    - [MS-EVEN6]: EventLog Remoting Protocol Version 6.0 - docs.ms
  - Talks/Presentations/Videos
    - EventID Field Hunter (EFH) – Looking for malicious activities in your Windows events - Rodrigo Montoro(Sector.ca2016)
      - In this talk we will discuss how we analyzed and scored each field from those events, ideas for implementation, projects, and results based on our deployment. We will illustrate how you can use EventID as a more powerful detection vector to identify specific user behaviors and activity patterns.
    - O Event, Where Art Thou? - Grzegorz Tworek(x33fcon2021)
  - Tools
    - EventLogParser
      - Parse PowerShell and Security event logs for sensitive information.
    - libevtx
      - Library and tools to access the Windows XML Event Log (EVTX) format
    - python-evtx
      - python-evtx is a pure Python parser for recent Windows Event Log files (those with the file extension ".evtx"). The module provides programmatic access to the File and Chunk headers, record templates, and event entries.
    - evtx
      - Golang Parser for Microsoft Event Logs
    - EVTXtract
      - EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
    - Tivan
      - Tivan is an utiliy to remotely retrieve logs from the Windows Event Log. Logs can be retrieved via RPC (MSEVEN6) or SOAP (WEC).
    - EVTX
      - A cross-platform parser for the Windows XML EventLog format
    - Windows Event Tools
      - Collection Of Scripts And Utilities For Windows Event Hunting
    - APT-Hunter
      - Blogpost
      - APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity. this tool will make a good use of the windows event logs collected and make sure to not miss critical events configured to be detected. If you are a Threat Hunter, Incident Responder or forensic investigator, i assure you will enjoy using this tool, why? i will discuss the reason in this article and how it will make your life easy just it made mine. Kindly note this tool is heavily tested but still a beta version and may contain bugs.
    - evtx-hunter
      - evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.
    - evtx-baseline
      - A repository hosting example goodware evtx logs containing sample software installation and basic user interaction
    - Log Extractor
      - A tool to extract Windows Event Logs into a reasonably usable json format for use with Elasticsearch, JQ, Grep, whatever..
- Event Tracing for Windows
  - 101
    - Event Tracing - docs.ms
    - About Event Tracing - docs.ms
    - Using Event Tracing - docs.ms
    - Event Tracing for Windows - Core OS Events in Windows 7, Part 1 - Dr. Insung Park, Alex Bendetovers
      - Part 2
    - Windows 10 ETW Events
      - Events from all manifest-based and mof-based ETW providers across Windows 10 versions
    - Tracing WMI Activity - docs.ms
    - Introduction to Threat Intelligence ETW - NtRaiseHardError(2020)
  - Articles/Blogposts/Writeups
    - ETW Event Tracing for Windows and ETL Files - Nicole Ibrahim(2018)
    - SilkETW: Because Free Telemetry is … Free! - Ruben Boonnen(2019)
      - Slides
    - A Primer On Event Tracing For Windows (ETW) - Nasreddine Bencherchali(2021)
    - Finding Detection and Forensic Goodness In ETW Providers - Nasreddine Bencherchali(2021)
    - Windows Event Trace Logs - Nicole Ibrahim
    - Tampering with Windows Event Tracing: Background, Offense, and Defense - Palantir
    - Getting started with Event Tracing for Windows in C# - Alex Khanin
    - Event Tracing for Windows and Network Monitor(2009)
      - "Event Tracing for Windows, (ETW), has been around for quite a while now as it was introduced in Windows 2000. It's basically instrumented logging that describes what a component is doing. Conceptually, it-s something like the proverbial printf("here1") concept used by programmers, but it is present in retail builds. When you enable logging in a component the result is an ETL (Event Trace Log) file. What-s new is that that Network Monitor can read any ETL file. And with the supplied parsers many network oriented ETW providers can be decoded."
    - Threat Hunting with ETW events and HELK — Part 1: Installing SilkETW - Roberto Rodriguez(2019)
    - German Gov Paid for Research into ETW
  - Talks/Videos
    - Production tracing with Event Tracing for Windows (ETW) - Doug Cook
    - Tracing Adversaries: Detecting Attacks with ETW - Matt Hastings & Dave Hull(Derbycon2017)
      - Event Tracing for Windows (ETW) is a powerful debugging and system telemetry feature that's been available since Windows 2000, but greatly expanded in recent years. Modern versions of Windows offer hundreds of ETW providers that are a veritable treasure trove of forensic data. This talk will take a fresh look at operationalizing ETW to combat contemporary intrusion methodologies and tradecraft. We'll walk through real world examples, covering both common malware behaviors and stealthy attacks that "live off the land", and demonstrate how to effectively utilize key ETW providers to detect and respond to these techniques.
    - ETW - Monitor Anything, Anytime, Anywhere - Dina Goldshtein(NDC Oslo 2017)
      - You’ll learn how to diagnose incredibly complex issues in production systems such as excessive garbage collection pauses, slow startup due to JIT and disk accesses, and even sluggishness during the Windows boot process. We will also explore some ways to automate ETW collection and analysis to build self-diagnosing applications that identify high CPU issues, resource leaks, and concurrency problems and produce alerts and reports. In the course of the talk we will use innovative performance tools that haven’t been applied to ETW before — flame graphs for visualising call stacks and a command-line interface for dynamic, scriptable ETW tracing. ETW is truly a window into everything happening on your system, and it doesn’t require expensive licenses, invasive tools, or modifying your code in any way. It is a critical, first-stop skill on your way to mastering application performance and diagnostics.
    - Hidden Treasure: Detecting Intrusions with ETW - Zac Brown(Derbycon2017)
      - Today, defenders consume the Windows Event Log to detect intrusions. While useful, audit logs don't capture the full range of data needed for detection and response. ETW (Event Tracing for Windows) is an additional source of events that defenders can leverage to make post-breach activity more visible in Windows. ETW provides a rich set of data, largely intended for debugging scenarios. As a side effect, these traces also have data that is ideal for detecting potentially malicious behavior, such as raw networking data and detailed PowerShell data. Unfortunately, the ETW API is low level and primitive, making it difficult to use at scale reliably. Because our security team in Office 365 supports monitoring over 150,000 machines, we needed a reliable way to consume the events in real-time, while adhering to strict memory and CPU usage constraints. To accomplish this, our team built the open-source krabsetw library to simplify dynamically consuming ETW events. We currently use this library to collect 6.5TB of data per day, from our service. In this talk, we’ll discuss a few ETW sources we’ve found to be high value as well as the detections they enable. We’ll also demo an example of using krabsetw as well as some considerations in using ETW in your intrusion detection pipeline at scale.
    - Windows Forensics: Event Trace Logs - Nicole Ibrahim(SANS DFIR Summit 2018)
      - This talk will cover what ETL files are and where you can expect to find them, how to decode ETL files, caveats associated with those files, and some interesting and forensically relevant data that ETL files can provide.
  - Tools
    - SilkETW & SilkService
      - SilkETW & SilkService are flexible C# wrappers for ETW, they are meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection. While both projects have obvious defensive (and offensive) applications they should primarily be considered as research tools. For easy consumption, output data is serialized to JSON. The JSON data can either be written to file and analyzed locally using PowerShell, stored in the Windows eventlog or shipped off to 3rd party infrastructure such as Elasticsearch.
    - ETW Python Library
      - ETW is a tracing facility that allows a user to log events to a file or buffer. An overview of ETW can be found here. The basic architecture includes an Provider, Controller, and a Consumer. The controller defines and controls a capture session. This includes what providers are in the as well as starting and stopping the session. The provider, specified using a GUID (Globally Unique Identifier), logs events to a series of buffers. The Consumer receives messages either from a buffer or a file and processes them in chronological order. This module is an entirely Python-based ctypes wrapper around the Win32 APIs necessary for for controlling ETW sessions and processing message data. The module is very flexible and can set pre or post capture filters.
    - EtwExplorer
      - View ETW Provider metadata
    - KrabsETW
      - KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
    - ProcMonX
      - Extended Process Monitor-like tool based on Event Tracing for Windows
    - ProcMonXv2
    - Sealighter
      - Sysmon-Like research tool for ETW
    - etwbreaker
      - An IDA Plugin to statically find ETW events in a PE file and generate a Conditional Breakpoint to facilitate Security Research.
    - UIforETW
      - User interface for recording and managing ETW traces
    - TiEtwAgent
      - PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
    - Winshark
      - Wireshark plugin to work with Event Tracing for Windows
- Logon Events
  - Audit logon events - docs.ms
    - Win10
- O365
  - Office 365 audit logging - Rik van Duijn(2021)
- Parsing
  - Parsing Text Logs with Message Analyzer - Microsoft
- PowerShell
  - 101
    - PowerShell ♥ the Blue Team - PowerShell Team(2015)
    - About Group Policy Settings - docs.ms
      - Describes the Group Policy settings for Windows PowerShell
    - Windows PowerShell Logging CheatSheet - Malware Archaeology
    - about_Logging_Windows - docs.ms
      - PowerShell logs internal operations from the engine, providers, and cmdlets to the Windows event log.
  - Articles/Blogposts/Writeups
  - Event Log
    - About Eventlogs - docs.ms
      - Windows PowerShell creates a Windows event log that is named "Windows PowerShell" to record Windows PowerShell events. You can view this log in Event Viewer or by using cmdlets that get events, such as the Get-EventLog cmdlet. By default, Windows PowerShell engine and provider events are recorded in the event log, but you can use the event log preference variables to customize the event log. For example, you can add events about Windows PowerShell commands.
    - PowerShell – Everything you wanted to know about Event Logs and then some - Przemyslaw Klys(2019)
  - Script Block Logging
  - Transcript Logging
    - PowerShell: Documenting your work with Start-Transcript - Patrick Gruenauer
    - PowerShell Security: Enabling Transcription Logging by using Group Policy - Patrick Gruenauer
  - Talks/Presentations/Videos
    - When Logging Everything Becomes an Issue - Edward Ruprecht(WWHF19)
      - Slides
      - Discussing potential issues with logging Sysmon and PowerShell logs. Potential sensitive data leakage, best practices, and scalability issues.
    - Invoke-Obfuscation: PowerShell obFUsk8tion - Daniel Bohannon(Hactivity2016)
      - "Today’s detection techniques monitor for certain strings in powershell.exe’s command-line arguments. While this provides tremendous value for most of today’s PowerShell attacks, I will introduce over a dozen obfuscation techniques that render today’s detection techniques grossly ineffective. These techniques will enable the innovative Red Team to continue using PowerShell undetected while challenging the Blue Team to identify these attacks more effectively. Finally, I will unveil Invoke-Obfuscation.ps1 which will enable both Red and Blue Teams to effortlessly create highly obfuscated PowerShell commands so organizations can test their detection capabilities against these obfuscation techniques."
    - Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science - Daniel Bohannon(BHUSA2017)
      - Attackers, administrators and many legitimate products rely on PowerShell for their core functionality. However, being a Windows-signed binary native on Windows 7 and later that enables reflective injection of binaries and DLLs and memory-resident execution of remotely hosted scripts, has made it increasingly attractive for attackers and commodity malware authors alike. In environments where PowerShell is heavily used, filtering out legitimate activity to detect malicious PowerShell usage is not trivial.
    - Hunting PowerShell Attacks on The Open Internet - Paul Melson(2019)
    - Hunting for PowerShell Abuse - Heirhabarov(2019)
      - Because of so prevalence of PowerShell among adversaries for Threat Hunters it is very important to be able to detect malicious uses of PowerShell and defend against it. In the presentation author is going to demostrate an approaches for detection of PowerShell abuses based on different event sources like native Windows logging capabilities as well as usage of additional tools, like Sysmon or EDR solutions. How to collect traces of using PowerShell, how to filter out false positives, and how to find evidence of malicious uses among the remaining after filtering volume of events — all these questions will be answered in the talk for present and future threat hunters.
    - Malicious payloads vs. deep visibility: a PowerShell story - Daniel Bohannon(PSConEU2019)
      - "This talk draws from over four years of Incident Response experience to lay out a technical buffet of in-the-wild malicious PowerShell payloads and techniques. In addition to diving deep into the mechanics of each malicious example, this presentation will highlight forensic artifacts, detection approaches and the deep visibility that the latest versions of PowerShell provides security practitioners to defend their organizations against the latest attacks that utilize PowerShell. So if you are new to security or just want to learn about how attackers have used PowerShell in their attacks, then this talk is for you. If you want to see what obfuscated and multi-stage, evasive PowerShell-based attacks look like under the microscope of PowerShell deep inspection capabilities, this talk is for you. And if you want to see why these security advancements to PowerShell are causing many attackers to shift their tradecraft development away from PowerShell, this talk is for you."
  - Tools
    - PowerShellMethodAuditor
    - Revoke-Obfuscation - Github
      - Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework.
    - block-parser
      - Parser for Windows PowerShell script block logs
    - EventList
      - EventList is a tool to help improving your Audit capabilities and to help to build your Security Operation Center. It helps you combining Microsoft Security Baselines with MITRE ATT&CK and generating hunting queries for your SIEM system - regardless of the product used.
    - GENE: Go Evtx sigNature Engine
      - The idea behind this project is to provide an efficient and standard way to look into Windows Event Logs (a.k.a EVTX files). For those who are familiar with Yara, it can be seen as a Yara engine but to look for information into Windows Events.
    - PSTrace
      - Trace ScriptBlock execution for powershell v2
    - Oriana
      - Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
- Task Scheduler
  - Enable Windows Task Scheduler History - A.J. Armstrong(2018)
- WMI
  - WMI-IDS
    - WMI-IDS is a proof-of-concept agent-less host intrusion detection system designed to showcase the unique ability of WMI to respond to and react to operating system events in real-time.
Monitoring
- Articles/Writeups
  - Practical PowerShell for IT Security, Part I: File Event Monitoring - varonis.com
  - How to: Configure network tracing - docs.ms
- Talks/Presentations/Videos
  - Sysinternals Video Library - Tour of the Sysinternals Tools - Mark Russinovich, David Solomon
  - How To Do Consolidated Endpoint Monitoring on a Shoe-String Budget - Derek Banks & Joff Thyer(2017)
    - Blogpost Writeup
- Understanding
- Tools
  - pywintrace
    - This module is an entirely Python-based ctypes wrapper around the Win32 APIs necessary for for controlling ETW sessions and processing message data. The module is very flexible and can set pre or post capture filters.
  - Openprocmon
    - open source process monitor
  - dankAlerts
    - dankAlerts is a fun way to learn about computer security, how Microsoft Windows program events are logged, and how to use these logs to alert you of previously unknown behavior that may be suspicious. dankAlerts is powered by Sysmon and Memes. dankAlerts presents anomalies to you in text written into meme images and guides you in order to reduce false positives.
  - ModuleMonitor
    - Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Injection attacks.
- Audit Policy
  - 101
    - Advanced security audit policy settings - docs.ms
      - This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. The security audit policy settings under Security Settings\Advanced Audit Policy Configuration can help your organization audit compliance with important business-related and security-related rules by tracking precisely defined activities
- Files/Folders
  - Articles/Writeups
    - Complete Guide to Windows File System Auditing - Jeff Petters(2017)
    - Challenges with Native File System Access Auditing - Farrah Gamboa(2019)
    - Windows File Activity Monitoring - Farrah Gamboa(2019)
    - Real-time file monitoring on Windows with osquery - trailofbits(2020)
      - Trail of Bits has developed ntfs_journal_events, a new event-based osquery table for Windows that enables real-time file change monitoring.
  - Tools
- Processes
  - Blue Team fundamentals Part Two: Windows Processes. - Pete(2017)
- Sysmon
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Sysmon Sessions with Carlos Perez(2021)
      - TrustedSec presented an interactive live stream session with Research Practice Lead Carlos Perez (@Carlos_Perez) to discuss Sysmon!
  - Tools
    - Sysmon Tools
      - Utilities for Sysmon
    - SysmonSearch
      - Investigate suspicious activity by visualizing Sysmon's event log
    - MSTIC Sysmon Resources
      - Anything Sysmon related from the MSTIC R&D team
  - Configs
    - sysmon-config - SwiftOnSecurity
      - This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file should function as a great starting point for system change monitoring in a self-contained and accessible package. This configuration and results should give you a good idea of what's possible for Sysmon. Note that this does not track things like authentication and other Windows events that are also vital for incident investigation.
    - sysmon-config - Neo23x0
      - This is a forked and modified version of @SwiftOnSecurity's sysmon config. It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the original version and extended the coverage with important new extensions.
    - Sysmon-config - deep-security
    - sysmon-modular
      - A repository of sysmon configuration modules
Windows Detection Engineering
- Articles/Writeups
  - Engineering Process Injection Detections - Part 1: Research - Jonathan Johnson(2020)
    - Code
  - [Execution - Powershell (T1086) - Rafael Bono, José Miguel Colmena]](https://ackcent.com/blog/execution-powershell-t1086/)
  - Detection Engineering with Kerberoasting Series
    - Part1 - Capability Abstraction - Jared Atkinson
    - Part2 - Detection Spectrum - Jared Atkinson
  - Host-based Threat Modeling & Indicator Design - Jared Atkinson(2017)
  - Thoughts on Host-based Detection Techniques - Jared Atkinson(2017)
  - Black Hat: Detecting the unknown and disclosing a new attack technique at Black Hat 2019 - Brian Donohue
    - Researchers Casey Smith and Ross Wolf demonstrated how to threat hunt for the unknown—and disclosed a new attack technique in the process—at the Black Hat security conference in Las Vegas, Nevada Thursday afternoon.
  - Uncovering The Unknowns: Mapping Windows API’s to Sysmon Events - Jonathan Johnson
  - Data Source Analysis and Dynamic Windows RE using WPP and TraceLogging - Matt Graeber(2019
- Talks/Videos
  - How do I detect technique X in Windows?? Applied Methodology to Definitively Answer this Question - Matt Graeber(2019)
    - Traditionally, the answer to this question has been to execute an attack technique in a controlled environment and to observe relevant events that surface. While this approach may suffice in some cases, ask yourself the following questions: ?Will this scale? Will this detect current/future variants of the technique? Is this resilient to bypass?? If your confidence level in answering these questions is not high, it?s time to consider a more mature methodology for identifying detection data sources. With a little bit of reverse engineering, a defender can unlock a multitude of otherwise unknown telemetry. This talk will establish a methodology for identifying detection data sources and will cover concepts including Event Tracing for Windows, WPP, TraceLogging, and security product analysis.
  - Endpoint Detection Super Powers on the cheap with Sysmon - Olaf Hartong(Derbycon2019)
  - Auditing and Bypassing Windows Defender Application Control - Matt Graeber
  - Attack Detect Defend Video Series(2021)
    - In this series of videos I explain how to Attack, Detect and Defend against common cyber techniques, aligned to Mitre's ATT&CK framework. Please check the video descriptions for links to further info and any corrections.
  - Insights Into Highly Valued Data Sources - Johnny Johnson, Olaf Hartong(ATT&CKcon3.0)
    - As defenders, we often find ourselves wanting "more" data. But why? Will this new data provide a lot of value or is it for a very niche circumstance? How many attacks does it apply to? Are we leveraging previous data sources to their full capability? Within this talk, Olaf and Jonny will walk through different data sources they leverage more than most when analyzing data within environments, why they do, and what these data sources do and can provide in terms of value to a defender.
  - EDR you covered ? Knowing your deficiencies - Olaf Harton(MITRE ATT&CK EU Workshop2021)
- Active Directory
  - Articles/Writeups
    - Detecting BloodHound - http://www.stuffithoughtiknew.com/(2019)
    - Active Directory (AD) Attacks & Enumeration at the Network Layer - Anton Ovrutsky(2020)
  - ACLs
    - Access Control Lists - docs.ms
  - DCSync
  - Kerberoast
    - Detecting Kerberoasting - Tim Medin(2020)
    - Kerberoasting with Jupyter Notebook - hx015
      - "In this blog, we will cover the process of creating a threat hunting notebook for the Kerberoasting technique."
    - Detecting Kerberos Relaying Attacks - Mehmet Ergene(2022)
    - Marshmallows & Kerberoasting - Paul Michaud, Charisa Persico(2022)
  - LDAP
  - Printer-related
    - Printnightmare Network Analysis - Dray Agha(2021)
  - User Logons
    - Detect Domain Admins Logons to Workstations - bh4b3sh(2020)
  - ZeroLogon
    - Detecting the CVE-2020–1472 (Zerologon) attacks - Bandar Alanazi(2020)
- Anti-Malware Scan Interface (AMSI)
  - Better know a data source: Antimalware Scan Interface - Jimmy Astle, Matt Graeber
- Browser Addons
- Child Processes
  - How to Design Abnormal Child Processes Rules without Telemetry - Menasec(2021
- COM
  - Articles/Writeups
    - What is the “DLLHOST.EXE” Process Actually Running - Nasreddine Bencherchali(2020)
- Credential Attacks
  - Detecting Attempts to Steal Passwords from Memory - David French(2018)
  - MiniDumpWriteDump via COM+ Services DLL - odzhan(2019)
  - Detecting Remote Credentials Dumping via comsvcs.dll - Cyb3rSn0rlax(2021)
  - Detecting shadow credentials - Christoph Falta(2022)
  - LookForLsassDumpInJournal.c
- DLLs
  - Detecting Dll Unhooking - makosec(2021)
- ETW
  - Articles/Writeups
    - EzETW — Got To Catch Them All… - SadProcessor(2022)
  - Tools
    - Sealighter-TI
      - Combining Sealighter with unpatched exploits and PPLDump to run the Microsoft-Windows-Threat-Intelligence ETW Provider without a signed driver.
    - ETWProcessMon2
      - ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
    - EzETW
      - Cmdlets for capturing Windows Events
    - etw-event-dumper
      - etw-event-dumper is designed for bulk collection of ETW event data for research purposes, in particular those scenerios where you know that there must be some relevant data in the ETW traces but you don't know what.
- Event Log
  - Tools
    - ntTraceControl -- Powershell Event Tracing Toolbox
      - ntTraceControl is a set of Powershell commands to forge/generate Windows logs. Simply put, ntTraceControl supports Detection teams by simplifying the testing of detection use cases and alerts without using complex infrastructure, tools, or the testing of vulnerabilities.
- Installers
  - Deception Engineering: exploring the use of Windows Installer Packages against first stage payloads - Ollie Whitehouse(2021)
- Kernel
  - Articles/Blogposts/Writeups
    - 4656(S, F): A handle to an object was requested. - docs.ms
      - "This event indicates that specific access was requested for an object. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device. If access was declined, a Failure event is generated. This event generates only if the object’s SACL has the required ACE to handle the use of specific access rights. This event shows that access was requested, and the results of the request, but it doesn’t show that the operation was performed. To see that the operation was performed, check “4663(S): An attempt was made to access an object.”"
    - Shellcode Detection Using Real-Time Kernel Monitoring - Alonso Candado()
    - Detecting EDR Bypass: Malicious Drivers(Kernel Callbacks) - Mehmet Ergene(2021)
- LNK
  - Articles/Blogposts/Writeups
    - A Chain Is No Stronger Than Its Weakest LNK - David French(BSidesSLC 2020)
- Mimikatz
  - YOU « TRY » TO DETECT MIMIKATZ ;) - Vincent Le Toux(HackInParis2019)
- Native Binaries
  - Articles/Writeups
  - Papers
    - Breaking Imphash - Chris Balles, Ateeq Sharfuddin(2019)
      - There are numerous schemes to generically signature artifacts. We specifically consider how to circumvent signatures based on imphash. Imphash is used to signature Portable Executable (PE) files and an imphash of a PE file is an MD5 digest over all the symbols that PE file imports. Imphash has been used in numerous cases to accurately tie a PE file seen in one environment to PE files in other environments, although each of these PE files' contents was different. An argument made for imphash is that alteration of imphashes of derived PE file artifacts is unlikely since it is an expensive process, such that you will need to either modify the source code and recompile or relink in a different order. Nevertheless, we present a novel algorithm that generates derivative PE files such that its imphash is different from the original PE file. This straightforward algorithm produces feasible solutions that defeat approaches relying on the impash algorithm to signature PE files.
  - Tools
    - Moneta
      - Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
    - MalMemDetect
      - Detect strange memory regions and DLLs
    - MapDetection
      - Detect manualmapped images remotely, without hassle
    - Shim-Process-Scanner
      - Windows x64 Process Scanner to detect application compatability shims
    - DLLLoadReasonEnumeratorWithWhen.cpp
      - Enumerates which DLL loaded when and why for each process via PEB enumeration
    - syscall-detect
      - PoC capable of detecting manual syscalls from usermode.
    - Memhunter
      - Presentation
      - "Automated hunting of memory resident malware at scale"
- .NET
  - Articles/Writeups
  - Tools
    - CollectDotNetEvents.ps1
      - A PoC script to capture relevant .NET runtime artifacts for the purposes of potential detections
    - ModuleMonitor
      - Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Injection attacks.
- Networking
  - Blue Team: Port Forwarding Detection! - CyberSecurity Hub(2020)
- NTLM-related
  - From idk: Looking for NTLMv1 use, look for EID 4624 where PackageName is "NTLM V1" with an exclude for ANONYMOUS LOGON
  - Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - docs.ms
  - Network security: Restrict NTLM: Audit incoming NTLM traffic - docs.ms
  - Network security: Restrict NTLM: Audit NTLM authentication in this domain - docs.ms
  - Detecting NTLM Relay Attacks - Mehmet Ergene(2021)
- PowerShell
  - Articles/Writeups
- Processes & Related
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Taking Hunting to the Next Level Hunting in Memory - Jared Atkinson 2017
    - Gargoyle Hunting In-Depth — by Aliz Hammond(Infosec in the City 2020)
      - Detecting certain user-mode code-hiding techniques, such as Josh Lospinoso's 'Gargoyle', is almost impossible from user-space. In this talk, I will examine Gargoyle, and explain how it can be detected from kernel mode. I will first walk through using WinDbg to locate hidden code and then write a Volatility plugin to turn this process into a practical method of detecting real-world attacks — in the process, adding a reliable method of differentiating these from legitimate behavior.
  - Tools
    - Hunt-Sleeping-Beacons
      - The idea of this project is to identify beacons which are unpacked at runtime or running in the context of another process.
    - Windows Process Property Enumeration Tools for Threat Hunting
      - The purpose of these tools is to enumerate traits of Windows processes that support the detection of process injection tradecraft used by threat actors.
    - ProcFilter
      - ProcFilter is a process filtering system for Windows with built-in YARA integration. YARA rules can be instrumented with custom meta tags that tailor its response to rule matches. It runs as a Windows service and is integrated with Microsoft's ETW API, making results viewable in the Windows Event Log. Installation, activation, and removal can be done dynamically and does not require a reboot. ProcFilter's intended use is for malware analysts to be able to create YARA signatures that protect their Windows environments against a specific threat. It does not include a large signature set. Think lightweight, precise, and targeted rather than broad or all-encompassing. ProcFilter is also intended for use in controlled analysis environments where custom plugins can perform artifact-specific actions.
    - Windows Executable Memory Page Delta Reporter
      - Blogpost
      - A Windows Service to performantly produce telemetry on new or modified Windows memory pages that are now executable every 30 seconds.
    - Patriot
      - Small research project for detecting various kinds of in-memory stealth techniques.
- Process Injection
  - Articles/Writeups
    - Reflective Injection Detection – Andrew King(Defcon20)
      - Tool
      - Slides
        
        This talk will focus on detecting reflective injection with some mildly humorous notes and bypassing said protections until vendors start actually working on this problem. It seems amazing that reflective injection still works. Why is that? Because programmers are lazy. They don't want to write new engines, they want to write definitions for an engine that already exists. So what do we do about it? Release a $5 tool that does what $50 AV has failed epically at for several years now...oh and it took me a week or so...Alternately, you could license it to vendors since their programmers are lazy.
    - Detecting reflective DLL injection - StackOverflow
    - DLL Injection - netbiosX(2017)
    - Detecting reflective DLL loading with Windows Defender ATP - Microsoft Defender Security Research Team(2017)
    - Detecting stealthier cross-process injection techniques with Windows Defender ATP: Process hollowing and atom bombing(2017)
    - Memory Injection Like a Boss - Noora Hyvärinen(2018)
    - Detecting process injection with ETW - @_lpvoid
    - Injecting Into The Hunt - Jonathan Johsnon(2019)
    - Engineering Process Injection Detections - Part 1: Research - Jonathan Johsnon(2020)
      - Part 2: Data Modeling - Jonathan Johsnon(2020)
      - Part 3: Analytic Logic - David Polojac(2020)
    - DLL Injection And Process Hollowing Detection in Pest Code Analysis - Omer(2020)
    - https://www.mertsarica.com/antimeter-tool/
  - Talks/Presentations/Videos
    - Taking Hunting to the Next Level: Hunting in Memory -Jared Atkinson, Joe Desimone(SANS Threat Hunting Summit2017)
      - In this talk, we will describe both common and advanced stealth malware techniques which evade today’s hunt tools and methodologies. Attendees will learn about adversary stealth and understand ways to detect some of these methods. Then, we will demonstrate and release a Powershell tool which will allow a hunter to automatically analyze memory across systems and rapidly highlight injected in-memory-only attacks across systems at scale. This will help move memory analysis from the domain of forensics to the domain of detection and hunting, allowing hunters to close the detection gap against in-memory threats, all without relying on without signatures.
    - Gargoyle Hunting In-Depth — Presented by Aliz Hammond()
      - Detecting certain user-mode code-hiding techniques, such as Josh Lospinoso's 'Gargoyle', is almost impossible from user-space. In this talk, I will examine Gargoyle, and explain how it can be detected from kernel mode. I will first walk through using WinDbg to locate hidden code and then write a Volatility plugin to turn this process into a practical method of detecting real-world attacks — in the process, adding a reliable method of differentiating these from legitimate behavior.
    - Part 2 - Investigation Hollow Process Injection Using Memory Forensics - Monnappa K A
    - PE-sieve: an open-source scanner for hunting and unpacking malware - hasherezade(2019)
      - Slides
  - Tools
    - Get-Injected-Thread.ps1
      - Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone
    - Detecting-Process-Injection-Techniques
      - This is a repository that is meant to hold detections for various process injection techniques.
    - pe-sieve
      - Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
    - MemProcFS-Analyzer
      - MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
    - eif
      - Evil Reflective DLL Injection Finder
    - reflective-injection-detection
      - A program to detect reflective dll injection on a live machine using a "naive" approach of looking for a PE header. The program also dumps other unlinked executable pages to the disk for your convenience.
    - hollows_hunter
      - Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
    - TiEtwAgent
      - PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
- RDP
  - Articles/Writeups
    - RDP - JPCERT
    - Detecting Rogue RDP - thickmints(2022)
- RPC
  - Articles/Writeups
  - Tools
    - MSRPC-To-ATT&CK
      - A repository that maps commonly used MSRPC protocols to Mitre ATT&CK while providing context around potential indicators of activity, prevention opportunities, and related RPC information.
    - mstscdump
      - The mstscdump utility allows unencrypted RDP packets being sent or received by MSTSC.EXE (or any other application that loads MSTSCAX.DLL) to be captured into a PCAP file for later analysis in various tools such as Microsoft Message Analyzer, Microsoft Network Monitor, or WireShark. It also demonstrates how to hook into the ActiveX interfaces exposed by MSTSCAX.DLL.
- Shellcode Runner
  - GOing 4 a Hunt
- SMB
  - Articles/Writeups
- Services
  - Articles/Writeups
    - Detecting Lateral Movement via Service Configuration Manager - Cyb3rSn0rlax
- Shellcode
  - Articles/Writeups
    - RIFT: Analysing a Lazarus Shellcode Execution Method - Research and Intelligence Fusion Team(RIFT)(2021
    - Using Memory Artifacts As Shellcode Emulation Environment (ft. Unicorn Framework) - DarunGrim(2020)
- Syscalls & WinAPI
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Reversing Engineering Syscalls To Evade Detection - OALabs(2022)
  - Tools
    - WinApiOverride
    - xLogger
      - Log windows API calls with parameters, calling module, thread id, return code, time, last status and last error based on a simple hooking engine
    - API-To-Event
      - A repo focused primarily on documenting the relationships between API functions and security events that get generated when using such functions.
    - SyscallExtractorAnalyzer
      - This script will pull and analyze syscalls in given application(s) allowing for easier security research purposes
    - EtwTi-Syscall-Hook
      - A simple program to hook the current process to identify the manual syscall executions on windows
    - tiny_tracer
      - A Pin Tool for tracing API calls etc
    - manual-syscall-detect
      - A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
    - Syscall-Monitor
      - Syscall Monitor is a system monitor program (like Sysinternal's Process Monitor) using Intel VT-X/EPT for Windows7+
    - NtMonitor.py
      - Frida script to spawn a process and monitor Native API calls
- User Behavior
  - Articles/Writeups
    - Oh, Behave! Figuring Out User Behavior - Oddvar Moe(2021)
      - Tool
- WMI
  - 101
    - Introduction to CIM Cmdlets - PowerShell Team(2012)](https://devblogs.microsoft.com/powershell/introduction-to-cim-cmdlets/)
    - What is CIM and Why Should I Use It in PowerShell? - Dr Scripto(2014)
    - What Does Deprecating WMIC Mean to the Blue Team? - Tareq Alkhatib(2022)
  - Articles/Writeups
  - Talks & Presentations
    - The Detection Series: Windows Management Instrumentation - RedCanary(2021)
  - Tools
    - WMI Process Watcher
- WoW64
  - Articles/Writeups
    - Monitoring Native Execution in WoW64 Applications: Part 1 - Yarden Shafir, Assaf Carlsbad
      - Part 2
      - Part 3
  - Talks & Presentations
    - Now On Stage! Deep Hooks: Monitoring Native Execution In WOW64 Applications - Assaf Carlsbad, Yarden Shafir(BSidesTLV2018)
- Tools/Tooling
  - PeaceMaker
    - PeaceMaker Threat Detection is a kernel-mode utility designed to detect a variety of methods commonly used in advanced forms of malware. Compared to a stereotypical anti-virus that may detect via hashes or patterns, PeaceMaker targets the techniques malware commonly uses in order to catch them in the act. Furthermore, PeaceMaker is designed to provide an incredible amount of detail when a malicious technique is detected, allowing for effective containment and response.
  - FalconEye
    - FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening (real-time). Since FalconEye runs in kernel mode, it provides a stronger and reliable defense against process injection techniques that try to evade various user-mode hooks.
- Workshops
  - Detecting-Adversarial-Tradecrafts-Tools-by-leveraging-ETW
    - CyberWarFare Labs hands-on workshop on the topic "Detecting Adversarial Tradecrafts/Tools by leveraging ETW"
- Misc
  - Mimikatz usage & detection - 0xf0x(2020)
Threat Hunting
- General
  - Articles/Writeups
    - Part 1: Intro to Threat Hunting with Powershell Empire, Windows event logs, and Graylog - Spartan2194(2017)
    - Spotting the Adversary with Windows Event Log Monitoring - NSA
    - Windows Event ID 4649 “A replay attack was detected “ — Oh really? Are we under ATTACK? Should we do Incident Response? - Iveco Aliza(2020)
    - Sysmon Threat Analysis Guide - Andy Green(2020)
    - Blue Team Hacks - Binary Rename
      - "In this post I thought I would share an interesting proof of concept I developed to detect Binary Rename of commonly abused binaries. Im going to describe the detection, its limitations and share the code."
    - Binary Rename 2
      - In this post I am focusing on static detection, that is assessing files on disk. I am going to describe differences between both Yara and Powershell based detections, then share the code.
    - Hunting ngrok Activity - Moath Maharmeth(2021)
    - Threat Hunting - Zero to Hero - Slavi Parpulev(2020)
  - Papers
    - Detecting Security Incidents Using Windows WorkstationEvent Logs - Russ Anthony(2013)
      - Windows event logs can be an extremely valuable resource todetect securityincidents. While many companies collect logs from security devices and critical serversto comply with regulatory requirements, few collect them from their windows workstations;even fewer proactively analyze theselogs. Collecting and analyzingworkstation logs is critical because it is increasinglyatthe workstation levelwherethe initial compromiseishappening.If we areto get better at detecting theseinitial compromisesthen it is imperative that we develop an efficient,common sense approach to collectingand analyzingthese events.
    - Windows Logon Forensics - Sunil Gupta(2013)
      - A compromised Windows® system's forensic analysis may not yield much relevant information about the actual target. Microsoft® Windows Operating System uses a variety of logon and authentication mechanisms to connect to remote systems over the network. Incident Response and Forensic Analysis outcomes are prone to errors without proper understanding of different account types, Windows logons and authentication methods available on a Windows platform. This paper walks thru the logon and authentication and how they are audited for various Windows account types’ logons for a successful investigation. In the process it describes common authentication protocols such as Kerberos, NTLM to better understanding of the logon process communications in the Windows environment.
    - Detecting Advanced Threats With Sysmon, WEF, and ElasticSearch - Josh Lewis(2015)
  - Talks & Presentations
    - Source Zero Con: Open-Source Forensic Threat Hunting - Ryan Boyle(SourceZeroCon2021)
  - Tools
    - ARTHIR
      - ATT&CK Remote Threat Hunting Incident Response (ARTHIR) is an update to the popular KANSA framework. ARTHIR works differently than KANSA in that you can create output with your ARTHIR module and then the results are pulled back to the launching host. KANSA only pulled console output back which limited its capabilities. KANSA was unable to execute binary utilities and tools such as LOGMD remotely and pull reports back. ARTHIR can run scripts as KANSA does, but also binary utilities and tools, making ARTHIR much more flexible than KANSA.
- Active Directory
  - 101
    - Monitoring Active Directory for Signs of Compromise - docs.ms
      - Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
    - Appendix L: Events to Monitor - docs.ms
      - The following table lists events that you should monitor in your environment, according to the recommendations provided in Monitoring Active Directory for Signs of Compromise.
    - Searching Active Directory Logs with PowerShell - Jeffrey Hicks(2021)
  - Articles/Writeups
  - Certificates
    - Threat Hunting Certificate Account Persistence - Pentestlaboratories(2021)
    - Certified Pre-Owned Detection Ideas - redhead0ntherun(2021)
  - Lateral Movement
    - The Lowdown on Lateral Movement - Anton Ovrutsky(2022)
  - LDAP
    - HOWTO: Detect Apps and Services using LDAP instead of LDAPS - Sander Berkouwer(2022)
    - Hunting suspicious LDAP queries in tons of logs - Mahdi Hatami(2022)
  - NTLM Relay
    - Detecting and Hunting for the PetitPotam NTLM Relay Attack - Michael Gough(2021)
  - Skeleton Key
    - Hunting for Skeleton Key Implants - Riccardo Ancarani(2021
  - Talks/Presentations/Videos
    - Detecting the Elusive Active Directory Threat Hunting - Sean Metcalf(BSidesCharm2017)
      - Attacks are rarely detected even after months of activity. What are defenders missing and how could an attack by detected? This talk covers effective methods to detect attacker activity using the features built into Windows and how to optimize a detection strategy. The primary focus is on what knobs can be turned and what buttons can be pushed to better detect attacks. One of the latest tools in the offensive toolkit is ""Kerberoast"" which involves cracking service account passwords offline without admin rights. This attack technique is covered at length including the latest methods to extract and crack the passwords. Furthermore, this talk describes a new detection method the presenter developed. The attacker's playbook evolves quickly, defenders need to stay up to speed on the latest attack methods and ways to detect them. This presentation will help you better understand what events really matter and how to better leverage Windows features to track, limit, and detect attacks.
      - Slides
  - Tools
    - WatchAD
      - After Collecting event logs and kerberos traffic on all domain controllers, WatchAD can detect a variety of known or unknown threats through features matching, Kerberos protocol analysis, historical behaviors, sensitive operations, honeypot accounts and so on. The WatchAD rules cover the many common AD attacks.
- AMSI
  - Antimalware Scan Interface Detection Optics Analysis Methodology: Identification and Analysis of AMSI for WMI - Matt Graeber(2019)
- Audit Policy
  - Articles/Writeup
    - Audit User/Device Claims - docs.ms
      - "Audit User/Device Claims allows you to audit user and device claims information in the account’s logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource."
  - Tools
    - Audix
      - Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
    - PSGumshoe
      - PSGumshoe is a Windows PowerShell module for the collection of OS and domain artifacts for the purposes of performing live response, hunt, and forensics. The module focuses on being as forensically sound as possible using existing Windows APIs to achieve the collection of information from the target host.
    - Windows-auditing-mindmap
      - Set of Mindmaps providing a detailed overview of the different #Windows auditing capacities and event log files.
- Attack Surface Reduction(ASR)
  - FalconFriday — Detecting ASR Bypasses — 0xFF17 - Henri Hambartsumyan(2021)
- Autoruns
  - How to Use Autoruns to Detect and Remove Malware on Windows - Neil Fox(2021)
- Azure
  - Articles/Writeups
    - Identifying Threat Hunting opportunities in your data - shainw
- Binaries
  - Import hashing (aka imphashes) - hacker0ni(2020)
- BITS
  - Articles/Writeups
- Browser Extensions
  - Articles/Writeups
    - Chrome Extensions: Bypassing your security - Pablo Delgado(2017)
      - Hunting Chrome extensions in Win AD environment with Sysmon and ELK.
    - FalconFriday — Detecting Malicious Browser Extensions and code signing- 0xFF01 - Olaf Hartong(2020)
- cmd.exe
  - Windows Command-Line Obfuscation - @Wietze(2021)
  - Malicious Command-Line (MAL-CL)
    - MAL-CL (Malicious Command-Line) aims to collect and document real world and most common "malicious" command-line executions of different tools and utilities while providing actionable detections and resources for the blue team.
- Camera & Mic
  - Can You Track Processes Accessing the Camera and Microphone on Windows 10? - Zachary Stanford(2020)
- Credential Access
  - Articles/Writeups
    - How to Detect Overpass-The-Hash Attacks - Jeff Warren
    - Hunting for Credentials Dumping in Windows Environment - Teymur Kheirhabaro(ZeroNights2017)
    - [Tales of a Threat Hunter 1: Detecting Mimikatz & other Suspicious LSASS Access - Part 1 - @darkQuassar(2017)(https://www.eideon.com/2017-09-09-THL01-Mimikatz/)
    - Deception in Depth - LSASS Injection - spookysec(2021) https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/
    - Fantastic Windows Logon types and Where to Find Credentials in Them - Chirag Salva, Anas Jamal(2021)
  - Papers
    - A Process is No One: Hunting for Token Manipulation - Jared Atkinson, Robby Winchester(2017)
      - In this paper, we will outline how we view hunting through our five step approach to perform hypothesis driven hunting. In addition, we will walk through a case study detecting Access Token Manipulation, highlighting the actions performed at each step of the process. At the conclusion of the paper, the reader should better understand hunting, our five-step hypothesis process, and how to apply it to real world scenarios.
  - Tools
    - ketshash
      - A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
- COM
  - Articles/Writeups
- CSharp
  - Interesting DFIR traces of .NET CLR Usage Logs - menasec.net
- DLLs
  - What is normal? Profiling System32 binaries to detect DLL Search Order Hijacking - Michael Haag, Shane Welcher(2021)
  - Hunting for Evidence of DLL Side-Loading With PowerShell and Sysmon - John Dwyer(2021)
  - Tools
    - Windows Feature Hunter
    - SideLoadHunter
      - SideLoadHunter is a PowerShell script and Sysmon configuration designed to aide defenders and incident responders identify evidence of DLL sideloading on Windows systems.
- Drivers
  - Detecting and Hunting for the Malicious NetFilter Driver - Michael Gough(2021)
  - Capturing Pcap driver installations - raggedlab(2020)
- Event Logs
  - Articles/Writeups
  - Talks/Presentations/Videos
    - What Event Logs? Part 1: Attacker Tricks to Remove Event Logs - Matt Bromiley(SANS DFIR 2018)
      - In part 1 of this series, SANS instructor and incident responder Matt Bromiley focuses on techniques, old and new, that attackers are using to neutralize event logs as a recording mechanism. Ranging from clearing of logs to surgical, specific event removal, in this webcast we will discuss how the attackers are doing what they're doing, and the forensic techniques we can use to detect their methods. There has been a lot of discussions lately about attackers' ability to fool the system into not writing event logs - but are our attackers truly staying hidden when they do this? Let's find out!
    - What Event Logs Part 2 Lateral Movement without Event Logs - Matt Bromiley(SANS DFIR 2018)
      - In part 2 of this series, SANS instructor and incident responder Matt Bromiley will discuss techniques to identify lateral movement when Windows Event Logs are not present. Sometimes logs roll without preservation, and sometimes attackers remove them from infected systems. Despite this, there are still multiple artifacts we can rely on to identify where our attackers came from, and where they went. In this webcast, we'll discuss the techniques and artifacts to identify this activity.
  - Tools
    - Search-Event.ps1
    - windows-basic-event-logs Mindmap
    - Evilize
      - "An incident response tool parses Windows Event Logs to export infection-related logs across many log files. Mainly following Hunt Evil SANS Poster to choose related events."
    - Chainsaw
      - Rapidly Search and Hunt through Windows Event Logs
- Execution & Executables
  - Articles/Blogposts/Writeups
  - Talks/Presentations/Videos
- FileSystem
  - OSQuery
  - Articles/Blogposts/Writeups
    - Complete Guide to Windows File System Auditing - Jeff Peters(2021)
  - Tools
    - Minispy File System Minifilter Driver
      - The Minispy sample is a tool to monitor and log any I/O and transaction activity that occurs in the system. Minispy is implemented as a minifilter.
    - Judge Jury and Executable
      - A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.
- File Downloads
  - Articles/Blogposts/Writeups
    - Downloads and the Mark-of-the-Web - ericlaw(2016)
- Group Policy
  - Group Policy Troubleshooting – helpful Event log categories - docs.ms
  - Lateral Movement Detection: GPO Settings Cheat Sheet - Compass Security(2020)
- Hidden Desktops
  - HiddenDesktopViewer
    - This tool reveals hidden desktops and investigate processes/threads utilizing hidden desktops
- HTML Smuggling
  - Articles/Blogposts/Writeups
    - Detecting HTML smuggling attacks using Sysmon and Zone.Identifier files - @securityjosh(2021)
    - Detecting Initial Access: HTML Smuggling and ISO Images — Part 1 - Mehmet Ergene(2021)
      - Detecting Initial Access: HTML Smuggling and ISO Images — Part 2 - Mehmet Ergene(2021)
- ISO Files
  - Articles/Writeups
    - Threat Thursday - Evading Defenses with ISO files like NOBELIUM - Jorge Orchilles(2021)
- Kernel-related
  - 101
    - 4656(S, F): A handle to an object was requested. - docs.ms
      - "This event indicates that specific access was requested for an object. The object could be a file system, kernel, or registry object, or a file system object on removable storage or a device. If access was declined, a Failure event is generated. This event generates only if the object’s SACL has the required ACE to handle the use of specific access rights. This event shows that access was requested, and the results of the request, but it doesn’t show that the operation was performed. To see that the operation was performed, check “4663(S): An attempt was made to access an object.”"
  - Articles/Writeups
    - Shellcode Detection Using Real-Time Kernel Monitoring - Alonso Candado()
    - Detecting EDR Bypass: Malicious Drivers(Kernel Callbacks) - Mehmet Ergene(2021)
  - Tools
    - Fibratus
      - "Fibratus is a tool for exploration and tracing of the Windows kernel. It lets you trap system-wide events such as process life-cycle, file system I/O, registry modifications or network requests among many other observability signals. In a nutshell, Fibratus allows for gaining deep operational visibility into the Windows kernel but also processes running on top of it."
- Lateral Movement
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Lateral Movement - Harlan Carvey(BSidesCincinnati(2015
    - Hunting Lateral Movement for Fun and Profit - Mauricio Velazco(Derbycon2017)
      - After obtaining an initial foothold on an environment, attackers are forced to embark in lateral movement techniques in order to be successful in identifying and exfiltrating sensitive information. To stay ahead of the bad guys, the Blue team needs to have a clear understanding of these techniques as well as the forensic artifacts these techniques leave behind on the victim hosts. Armed with this knowledge, we can proactively hunt for lateral movement in the environment before exfiltration can occur. This presentation will analyze Lateral Movement from both a Red and Blue team perspective and introduce Oriana, a lateral movement hunting tool that can assist the Blue team in catching the adversary.
    - How to Hunt for Lateral Movement on Your Network - Ryan Nolette(Derbycon2017)
    - Spotting Lateral Movement with Endpoint Data - Tony Lambert(BSides Augusta2019)
  - Tools
    - kethash
      - A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
- LoLBins
  - Articles/Writeups
- Macros
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Hunting Malicious Office Macros - Anton Ovrutsky(2021)
      - Malicious Office Macros are used by threat actors in order to gain an initial foothold within enterprise networks; often followed by devastating ransomware deployments. This talk will cover what data sources are required to gain visibility into macro executions, how to baseline such executions in an environment, how to effectively filter out less risky macro executions and finally, how to hunt for malicious macro usage in environments. Queries, sample Sysmon configurations as well as data sets will be released as well.
- .NET
  - Articles/Writeups
    - Using .NET GUIDs to Hunt .NET Malware - Brian Wallace(2015)
    - Interesting DFIR traces of .NET CLR Usage Logs - menasec.net
    - Deep Dive: .NET Malware — Peeling Back the Layers - John Ferrell(2018)
    - Hunting For In-Memory .NET Attacks - Joe Desimone(2017)
    - Hunting for SILENTTRINITY - Wee-Jing Chung(2019)
      - SILENTTRINITY (byt3bl33d3r, 2018) is a recently released post-exploitation agent powered by IronPython and C#. This blog post will delve into how it works and techniques for detection.
    - Analysis: Abuse of .NET features for compiling malicious programs - Karen Victor and Matthew Fernandez(2020)
    - Using Windows Antimalware Scan Interface in .NET - Gérald Barré(2020)
    - Detecting and Advancing In-Memory .NET Tradecraft - Dominic Chell(2020)
    - Detecting attacks leveraging the .NET Framework - Zac Brown, Shane Welcher(2020)
    - Hiding Your .NET – ETW - Adam Chester(2020)
    - CIMplant Part 1: Detection of a C# Implementation of WMImplant - FortyNorthSecurity(2021)
    - Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion - Bohops(2021)
    - Finding .Net Assemblies - Michael Haag(2022) https://securelist.com/detection-evasion-in-clr-and-tips-on-how-to-detect-such-attacks/104226/
  - Tools
    - ClrGuard
      - ClrGuard is a proof of concept project to explore instrumenting the Common Language Runtime (CLR) for security purposes. ClrGuard leverages a simple appInit DLL (ClrHook32/64.dll) in order to load into all CLR/.NET processes. From there, it performs an in-line hook of security critical functions. Currently, the only implemented hook is on the native LoadImage() function. When events are observed, they are sent over a named pipe to a monitoring process for further introspection and mitigation decision.
    - Sniper
      - A simple proof of concept for detecting use of Cobalt Strike's execute-assembly
    - Rogue Assembly Hunter
      - Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
- Named Pipes
  - Articles/Writeups
- Network-Facing Services
  - Articles/Writeups
    - WebDAV Traffic To Malicious Sites - Didier Stevens
      - TL;DR: when files are retrieved remotely with the file:// URI scheme on Windows, Windows will fallback to WebDAV when SMB connections can not be established.
- Pass-the-Hash
  - Pass The Hash: What is? and how can we detect it? - Ariel Millahuel(2021)
- Persistence
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Obtaining and Detecting Domain Persistence - Grant Bugher(DEF CON 23)
      - When a Windows domain is compromised, an attacker has several options to create backdoors, obscure his tracks, and make his access difficult to detect and remove. In this talk, I discuss ways that an attacker who has obtained domain administrator privileges can extend, persist, and maintain control, as well as how a forensic examiner or incident responder could detect these activities and root out an attacker.
  - Tools
    - Windows-Hunting
      - (Has info on Persistence) The Purpose of this repository is to aid windows threat hunters to look for some common artifacts during their day to day operations.
- PowerShell
  - Articles/Writeups
    - Pulling Back the Curtains on EncodedCommand PowerShell Attacks - Jeff White(2017)
    - Hunting for AMSI bypasses - Wee-Jing Chun(2019)
    - Revoke -‐ Obfuscation: PowerShell Obfuscation Detection Using Science
    - Attack and Defense Around PowerShell Event Logging - Mina Hao(2019)
      - Blogpost discussing logging mechanisms in PowerShell up to v6.
    - Greater Visibility Through PowerShell Logging - Matthew Dunwoody(2016)
    - DeepBlueCLI
      - a PowerShell Module for Threat Hunting via Windows Event Logs
    - Securing PowerShell in the Enterprise - Australian Cyber Security Center(2020)
      - This document describes a maturity framework for PowerShell in a way that balances the security and business requirements of organisations. This maturity framework will enable organisations to take incremental steps towards securing PowerShell across their environment; Appendix E - Strings for log analysis
    - From PowerShell to P0W3rH3LL – Auditing PowerShell - ingmar.koecher(2018)
    - Practical Behavioral Profiling of PowerShell Scripts through Static Analysis (Part 1) - Jeff White(2019)
      - Part 2
      - Part 3
    - Uncovering Indicators of Compromise (IoC) Using PowerShell, Event Logs, and a Traditional Monitoring Tool
    - Detecting Offensive PowerShell Attack Tools - adsecurity.org
    - Attack and Defense Around PowerShell Event Logging - Mina Hao(2019)
      - This document dwells upon security features of the logging function of major versions of PowerShell, as well as attack means, ideas, and techniques against each version of the event viewer.
    - Detecting Modern PowerShell Attacks with SIEM - Justin Henderson
    - Taking a Closer Look at PowerShell Download Cradles - Pwntario(2020
    - Detecting AMSI Bypass - Ionize(2020)
    - PowerShell Security: Is itEnough? - Timothy Hoffman
      - "This paper aims to analyze a PowerShell-based attack campaign and evaluate each security feature in its ability to effectively prevent or detect the attacksindividually and collectively. These results will in no way be all inclusive, as technology is ever-changing, andnewmethods are emergingto counteract current security measures"
    - [Threat Hunting AMSI Bypasses - netbiosX(2021)](https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/()
  - Talks/Presentations/Videos
    - Hunting for PowerShell Abuse - Teymur Kheirkhabarov(Offzone2019)
      - Slides
      - In the presentation author is going to demostrate an approaches for detection of PowerShell abuses based on different event sources like native Windows logging capabilities as well as usage of additional tools, like Sysmon or EDR solutions. How to collect traces of using PowerShell, how to filter out false positives, and how to find evidence of malicious uses among the remaining after filtering volume of events — all these questions will be answered in the talk for present and future threat hunters.
    - Tracking Activity and Abuse of PowerShell - Carlos Perez(PSConEU 2019)
      - Slides
    - Investigating PowerShell Attacks - Ryan Kazanciyan, Matt Hastings(BHUSA2014)
      - Paper
      - This presentation will focus on common attack patterns performed through PowerShell - such as lateral movement, remote command execution, reconnaissance, file transfer, and establishing persistence - and the sources of evidence they leave behind. We'll demonstrate how to collect and interpret these forensic artifacts, both on individual hosts and at scale across the enterprise. Throughout the presentation, we'll include examples from real-world incidents and recommendations on how to limit exposure to these attacks."
    - PowerShell Inside Out: Applied .NET Hacking for Enhanced Visibility - Satoshi Tanda(2017)
      - "This talk will discuss how to gain greater visibility into managed program execution, especially for PowerShell, using a .NET native code hooking technique to help organizations protect themselves from such advanced attacker techniques. In this session, we will demonstrate how to enhance capabilities provided by AMSI and how to overcome its limitations, through a realistic implementation of the technique, all while analyzing the internals of .NET Framework and the PowerShell engine."
    - Catching the Guerrilla: Powershell Counterinsurgency - Aaron Sawyer(CircleCityCon2019)
      - For too long attackers have leveraged the built-in APIs and tooling on Windows systems against us. It's time the tables are turned! Those APIs were made for Sys Admins and defenders... and we're taking them back! We're building a framework of response tools for defenders to wrestle control from threat actors without the risk of production outages. This talk will focus on techniques to turn the limited and traditional black-and-white incident response options into a full-color spectrum of alternatives for defending your turf. Attendees will walk away with ideas on how to leverage existing third-party Powershell scripts to stop intruders in their tracks and are encouraged to offer use cases that will produce more tools in the future.
  - Tooling
    - AMSIDetection
    - Kansa
      - A modular incident response framework in Powershell. It's been tested in PSv2 / .NET 2 and later and works mostly without issue. It uses Powershell Remoting to run user contributed, ahem, user contri- buted modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline.
    - AmsiPatchDetection
    - PSGumshoe
      - PSGumshoe is a Windows PowerShell module for the collection of OS and domain artifacts for the purposes of performing live response, hunt, and forensics.
- Privilege Escalation
  - Articles/Writeups
  - Talks/Presentations/Videos
    - Hunting for Privilege Escalation in Windows Environment - Teymur Kheirkhabarov(OffZone2018)
      - Slides
- Processes
  - 101
    - memory-hunting Mindmap
  - Articles/Writeups
  - Papers
    - Windows Memory Forensics: Detecting (Un)Intentionally Hidden Injected Code by Examining Page Table Entries - Frank Block, Andreas Dewald(2019)
      - Malware utilizes code injection techniques to either manipulate other processes (e.g. done by banking trojans) or hide its existence. With some exceptions, such as ROP gadgets, the injected code needs to be executable by the CPU (at least at some point in time). In this work, we cover and evaluate hiding techniques that prevent executable pages (containing injected code) from being reported by current detection tools. These techniques can either be implemented by malware in order to hide its injected code (as already observed) or can, in one case, unintentionally be taken care of by the operating system through its paging mechanism. In a second step, we present an approach to reveal such pages despite the mentioned hiding techniques by examining Page Table Entries. We implement our approach in a plugin for the memory forensic framework Rekall, which automatically reports any memory region containing executable pages, and evaluate it against own implementations of different hiding techniques, as well as against real-world malware samples.
  - Talks/Presentations/Videos
    - Hunting for Memory-Resident Malware - Joe Desimone(Derbycon2017)
      - Once a staple of nation state level adversaries, memory-resident malware techniques have become ubiquitous even for lowly criminal activity. With their ability to evade endpoint protection products, it is critical for defenders to understand and defend against these techniques. In this talk, I will describe both common and advanced stealth malware techniques which evade today's hunt tools and methodologies. Attendees will learn about adversary stealth and understand ways to detect some of these methods. New code for rapidly hunting for these techniques across your enterprise will be released.
    - Gargoyle Hunting In-Depth — Aliz Hammond(Infosec In the City(2020)
      - Detecting certain user-mode code-hiding techniques, such as Josh Lospinoso's 'Gargoyle', is almost impossible from user-space. In this talk, I will examine Gargoyle, and explain how it can be detected from kernel mode. I will first walk through using WinDbg to locate hidden code and then write a Volatility plugin to turn this process into a practical method of detecting real-world attacks — in the process, adding a reliable method of differentiating these from legitimate behavior.
    - DMA Abuses and In-Memory Malware Detection - Ulf Frisk - HelSec Virtual meetup #5
      - PCILeech has become the defacto standard for PCIe DMA attacks amongst researchers, red teamers, governments and game cheaters alike. Hyper-V host-to-guest is now supported as well. I will demo how to inject and execute code in the kernel; live edit memory with IDA and much more. MemProcFS is memory forensics made super easy! Analyze memory dumps or live memory by clicking on files in a virtual file system using your favorite tools. Find injected malware in seconds, recover files or take a peek at process internals. MemProcFS is 100% open source memory forensics, blazingly fast and super easy to use!
    - Tricking modern endpoint security products - Michel Coene(SANS2020)
      - The current endpoint monitoring capabilities we have available to us are unprecedented. Many tools and our self/community-built detection rules rely on parent-child relationships and command-line arguments to detect malicious activity taking place on a system. There are, however, ways the adversaries can get around these detections. During this presentation, we'll talk about the following techniques and how we can detect them: Parent-child relationships spoofing; Command-line arguments spoofing; Process injection; Process hollowing
  - Tools
    - GetInjectedThreads.cs
      - C# Implementation of Jared Atkinson's Get-InjectedThread.ps1
    - Memhunter
      - "The tool is a standalone binary that, upon execution, deploys itself as a windows service. Once running as a service, memhunter starts the collection of ETW events that might indicate code injection attacks. The live stream of collected data events is feed into memory inspection scanners that use detection heuristics to down select the potential attacks. The entire detection process does not require human intervention, neither memory dumps, and it can be performed by the tool itself at scale."
    - Moneta
      - Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
    - PE-sieve
      - PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches. Detects inline hooks, Process Hollowing, Process Doppelgänging, Reflective DLL Injection, etc.
    - memhunter
      - Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis process and remediation times. The tool detects and reports memory-resident malware living on endpoint processes. Memhunter detects known malicious memory injection techniques. The detection process is performed through live analysis and without needing memory dumps. The tool was designed as a replacement of memory forensic volatility plugins such as malfind and hollowfind. The idea of not requiring memory dumps helps on performing the memory resident malware threat hunting at scale, without manual analysis, and without the complex infrastructure needed to move dumps to forensic environments. Besides the data collection and hunting heuristics, the project has also led to the creation of a companion tool called "minjector" that contains +15 code injection techniques. The minjector tool cannot onlybe used to exercise memhunter detections, but also as a one-stop location to learn on well-known code injection techniques out there.
    - check_ioc
      - Check_ioc is a script to check for various, selectable indicators of compromise on Windows systems via PowerShell and Event Logs. It was primarily written to be run on a schedule from a monitoring engine such as Nagios, however, it may also be run from a command-line (for incident response).
    - hollows_hunter
      - Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
    - Get-InjectedThread.ps1
      - Looks for threads that were created as a result of code injection.
    - spoofchecker.py
    - ppid-spoofing
    - Captain
      - "Captain is an endpoint monitoring tool that aims at spotting malicious events through API hooking, improving the process of threat hunting analysis . When a new process is created, Captain will inject a dll into it hooking some Windows API functions."
- RDP
  - Articles/Writeups
    - RDP Event Log DFIR - Mike Cary(2019)
    - Outbound RDP Surprises - Justin Vaicaro()
      - The goal of this blog post is not to dissect the threat hunting process or dive into the various hunting strategies and tactics. Rather, the intent is to show the importance of focusing on a legitimate protocol within a threat hunt engagement that can be easily used for potential data exfiltration, hide in plain sight with other normal traffic, and go unnoticed by a security operations center (SOC) that is untrained to identify potentially suspicious network behavior.
    - Windows Forensic Analysis: some thoughts on RDP related Event IDs - Andrea Fortuna(2020)
  - Talks/Presentations/Videos
    - Threat Hunt Deep Dives Ep. 6 - Living off the Land (LotL) Pt. 2, RDP Hijacking with Tscon.exe - Lee Arkinahl(2021
      - Welcome to Threat Hunt Deep Dives, Episode 6! Today we are looking at a Living off the Land (LotL) technique involving Tscon.exe, which is a Windows native binary, and users with inactive sessions. Join us as we put these techniques under the microscope.
- Registry
  - Articles/Writeups
    - Threat Hunting with Data Science: Registry Run Keys - Mehmet Ergene(2021)
    - Malicious Registry Timestamp Manipulation Technique: Detecting Registry Timestomping - inversecos(2022)
  - Tools
    - Process Monitor
    - reg_hunter
      - Blueteam operational triage registry hunting/forensic tool.
    - Registry_Monitor
      - A Windows script to monitor registry hives for modifications & notify you when modifications have occured.
- RunDLL32
  - Detecting RunDLL32 ATT&CK Techniques - Andrew Skatoff(2020)
- SACLs
  - Detecting Windows Endpoint Compromise with SACLs - Dane Stuckey(2018)
- Scheduled Tasks
  - Articles/Writeups
    - Scheduled Task Tampering - Riccardo Ancarani(2022)
    - Hunting for the Behavior: Scheduled Tasks - Mehmet Ergene(2021)
- ShimCache
  - Articles/Writeups
    - Is Windows ShimCache a threat hunting goldmine? - Tim Bandos
- Services
  - Articles/Writeups
    - Services: Windows 10 Services(ss64)
      - A list of the default services in Windows 10 (build 1903).
    - Hunting for SCShell Usage Using ELK - Riccardo Ancarani(2019)
    - Investigating a Suspicious Service - Chris Basnett(2021)
    - Threat Hunting #26 - Remote Windows Service Creation / Recon - Menasec(2019)
- Sysmon
  - 101
    - Sysinternals Sysmon suspicious activity guide - blogs.technet
    - SysmonCommunityGuide
      - TrustedSec Sysinternals Sysmon Community Guide
    - (SwiftOnSecurity's )sysmon-config
      - Sysmon configuration file template with default high-quality event tracing
  - Articles/Writeups
    - SysInternals: SysMon Unleashed
    - Threat Hunting: Fine Tuning Sysmon & Logstash to find Malware Callbacks C&C - Pablo Delgado
    - Tales of a Blue Teamer: Detecting Powershell Empire shenanigans with Sysinternals - Spartan2194(2019)
    - Visualise Sysmon Logs and Detect Suspicious Device Behaviour -SysmonSearch-
      - JPCERT/CC has developed and released a system “SysmonSearch” which consolidates Sysmon logs to perform faster and more accurate log analysis. We are happy to introduce the details in this article.
    - Investigate Suspicious Account Behaviour Using SysmonSearch
      - In a past article in September 2018, we introduced a Sysmon log analysis tool "SysmonSearch" and its functions. Today, we will demonstrate how this tool can be used for incident investigation by showing some examples.
    - sysmon-cheatsheet
      - All sysmon event types and their fields explained
  - Talks & Presentations
    - Implementing Sysmon and Applocker - BHIS
      - In almost every BHIS webcast we talk about how important application whitelisting and Sysmon are to a healthy security infrastructure. And yet, we have not done a single webcast on these two topics. Let's fix that. In this webcast we cover how to implement Sysmon and Applocker. We cover overall strategies for implementation and how to deploy them via Group Policy. We walk through a basic sample of malware and show how both of these technologies react to it. Finally, we cover a couple of different "bypass" techniques for each. Everything in security has weaknesses, and these two technologies are no exception.
    - Threat Hunting via Sysmon - Eric Conrad(SANS Blue Team Summit 2019)
      - Windows Sysinternal's Sysmon offers a wealth of information regarding processes running in a Windows environment (including malware). This talk will focus on leveraging Sysmon logs to to centrally hunt malice in a Windows environment. Virtually all malware may be detected via event logs, especially after enabling Sysmon logs.
    - Endpoint Detection Super Powers on the cheap, with Sysmon - Olaf Harton(Derbycon2019)
      - Based on my experience as a blue and purple teamer I wanted to create a workflow toolkit for anyone with access to Splunk to get started with a set of tools that enables them to hit the ground running on a tight budget without compromising on quality. I will explain the pain of lacking visibility in a common Enterprise environment. I will present my hunting app, which contains over 150 searches and over 15 dashboards. Knowledge is power; The workflow has been intentionally built on generic searches to cover all attack variations, to be able to uncover most potentially malicious behaviour. The dashboards contain overviews, threat indicators and facilitate consecutive drilldown workflows to help the analyst determine whether this is a threat or not and allow them to whitelist.
    - Sysmon Monitoring Different Way - Marek Mikita(BSides Vancouver(2021)
      - "Why have all sysmon logs and not look into this differently. I working on simple graphical visualization for sysmon logs for quick threat hunting and solving all problems. Attackers always come with some bright idea why not to look into sysmon logs as graphs. I would like to release my small docker project when you can start looking for misbehavior of your system. Graph will show connection between processes. Also there will be option to see which DNS request and services was started or stopped. Interface provide simple design for review your graph in different views. There is option to see all current processes on graph. They also provide details about certain processes as PID, name, version, date of execution if available."
  - Tools
    - SysmonGraph
      - Sysmon Graph is project to visualize sysmon logs.
    - SysmonSimulator
      - "SysmonSimulator is an Open source Windows event simulation utility created in C language, that can be used to simulate most of the attacks using WINAPIs. This can be used by Blue teams for testing the EDR detections and correlation rules. I have created it to generate attack data for the relevant Sysmon Event IDs."
- TimeStomp
  - Defence Evasion Technique: Timestomping Detection – NTFS Forensics - inversecos(2022)
- Tokens
  - Articles/Writeups
  - Papers
    - A Process is No One: Hunting for Token Manipulation - Jared Atkinson, Robby Winchester
      - Paper
      - Hunting has become a very popular term and discipline in information security, but there are many different definitions and perspectives surrounding the practice. In this paper, we will outline how we view hunting through our five step approach to perform hypothesis driven hunting. In addition, we will walk through a case study detecting Access Token Manipulation, highlighting the actions performed at each step of the process. At the conclusion of the paper, the reader should better understand hunting, our five-step hypothesis process, and how to apply it to real world scenarios
  - Talks & Presentations
    - Detecting Access Token Manipulation - William Burgess(BHUSA2020)
      - This presentation aims to demystify how access tokens work in Windows environments and show how attackers abuse legitimate Windows functionality to move laterally and compromise entire Active Directory domains. Most importantly, it will cover how to catch attackers in the act, and at scale, across enterprises.
- UAC
  - Articles/Writeups
    - FalconFriday — Detecting UAC Bypasses — 0xFF16 - Gijs Hollestelle(2021)
    - Exploring Windows UAC bypasses: Techniques and detection strategies - Elastic Security Team(2022)
  - Talks & Presentations
    - Threat Hunt Deep Dives Ep. 7 - User Account Control Bypass via Registry Modification - Lee Arkinhal(2021)
- WMI
  - Articles/Writeups
    - Investigating WMI Attacks - Chad Tilbury(2019)
  - Talks & Presentations
  - Tools
    - BLUESPAWN
      - BLUESPAWN is an active defense and endpoint detection and response tool which means it can be used by defenders to quickly detect, identify, and eliminate malicious activity and malware across a network.
  - CimSweep
    - CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CimSweep may also be used to engage in offensive reconnaisance without the need to drop any payload to disk.
- Tools
  - PowerHunt
    - PowerHunt is a modular threat hunting framework written in PowerShell that leverages PowerShell Remoting for data collection on scale.
  - Winterfell-Hunt
    - Winterfell hunt is a python script to perform auto threat hunting for malicious activities in windows OS based on collected data by winterfell collection package
Cobalt Strike
- Attacking it
  - Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability - NCCGroup(2020
- Collections
  - Awesome-CobaltStrike-Defence
- Extracting & Analyzing Payloads
  - Articles/Blogposts/Writeups
    - [Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1 - Didier Stevens(2021)]
  - Tools
    - Cobalt Strike Configuration Extractor and Parser
    - Sniper
      - A simple proof of concept for detecting use of Cobalt Strike's execute-assembly
    - CobaltStrikeScan
      - Scan files or process memory for CobaltStrike beacons and parse their configuration
    - CobaltStrikeParser
      - Python parser for CobaltStrike Beacon's configuration
    - CobaltStrikeDetected
    - 1768 K - Didier Stevens
      - This tool decodes and dumps the configuration of Cobalt Strike beacons.
    - BeaconEye
      - BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity.
- Hunting it
  - Articles/Blogposts/Writeups
    - The art and science of detecting Cobalt Strike - Nick Mavis(2020)
    - Getting the Bacon from the Beacon - Kareem Hamdan, Lucas Miller(2020)
    - "This blog discusses CrowdStrike’s research and testing of Cobalt Strike’s Beacon in an isolated Active Directory domain to identify host-based indicators generated from the use of this tool. This blog also enumerates and provides an explanation of host-based artifacts generated as a result of executing specific built-in Beacon commands. The artifacts can be used to create detection and prevention signatures in Windows environments, aiding in the positive identification of remnants of Beacon execution."
    - Detecting Cobalt Strike with memory signatures - Joe Desimone(2021
    - How to detect CobaltStrike Command & Control communication - Bogdan Vennyk
    - Cobalt Strike Hunting — simple PCAP and Beacon Analysis - Michael Koczwara(2021)
    - Cobalt Strike Hunting — DLL Hijacking/Attack Analysis - Michael Koczwara(2021) Guide to Named Pipes and Hunting for Cobalt Strike Pipes - svchOst(2021)
    - Cobalt Strike DFIR: Listening to the Pipes - bmcder02(2021)
    - Cobalt Strike and Tradecraft - Hausec(2021)
    - Detecting C&C Malleable Profiles - Lee Kirkpatrick(2021)
    - Detecting Exposed Cobalt Strike DNS Redirectors - Riccardo Ancarani, Giulio Ginesi(2021)
    - Collecting Cobalt Strike Beacons with the Elastic Stack - Derek Ditch, Daniel Stepanic, Andrew Pease, Seth Goodwin(2022)
    - Sleep Mask Kit IOCs - CodeX(2022)
  - Tools
    - DetectCobaltStomp
      - Detects Module Stomping as implemented by Cobalt Strike
    - BeaconHunter
      - "Behavior based monitoring and hunting tool built in C# tool leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons."

Data Storage & Analysis Stacks

ELK Stack

101
- Introduction to ELK Stack: A primer for beginners - Elastic.co
- Introduction to logging with the ELK Stack - Elastic.co
- The Complete Guide to the ELK Stack - Dotan Horovitz(2020)
- In depth guide to running Elasticsearch in production - Mattis Haase(2020)
- Learning Elasticsearch Basic Easily - Elye(2021)
- Detection Rules
  - Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine.
Setting up a lab
- See 'Building_a_Lab.md'
ElasticSearch
LogStash
- LogStash
  - Logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). If you store them in Elasticsearch, you can view and analyze them with Kibana. It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
- Getting Started With Logstash
- Logstash Documentation
- logstash anonymize * Anonymize fields using by replacing values with a consistent hash.
Kibana
- 101
  - Kibana
    - Kibana is an open source (Apache Licensed), browser based analytics and search dashboard for Elasticsearch. Kibana is a snap to setup and start using. Kibana strives to be easy to get started with, while also being flexible and powerful, just like Elasticsearch.
  - Introduction to Kibana
- Reference
  - Kibana Documentation/Guides
  - Installing Kibana
- Articles/Writeups
Talks/Presentations/Videos
- Hands on with Elastic SIEM: Defending your organization with the Elastic Stack
- Dive into DSL: Digital Response Analysis with Elasticsearch - Brian Marks, Andrea Sancho Silgado(Derbycon2016)
  - In this talk we will take a deep dive into the Elasticsearch DSL using python and how you can use it to go beyond the simple searches you may have been using in Kibana. We will demonstrate how Elasticsearch can be used to speed up and automate your DFIR investigations by grouping multiple queries of artifacts into a ?signature of forensics? format to answer common investigator questions. In addition, this talk will explore the full power of elasticsearch?s searching and aggregation capabilities that can be utilized with indexed artifacts as well as the visualization functionality of Kibana. Use cases and code samples from real world investigations will be presented showing how you tap into this functionality already built into your ELK stack!
- Build yourself an Elastic Threat Hunting and Monitoring SIEM - Ronnie Watson(BSidesHSV2021)
  - "This presentation will be covering Elastic SIEM security features on how this platform will enable a SOC Analyst to Hunt, Discover and look for Threats in any organization. To quickly engage and stop emerging adversaries from taking over their networks."
- Threat Hunting with Elastic Stack - Code In Action(2021)
- Threat hunting with Logstash - Elastic(2021)
  - In this talk we will see how to use Shodan and Logstash to hunt for threats. We will use the Shodan API to collect data. Then we’ll use a simple Python script to sift through the results and feed it to the ELK Stack. Once all of this is set up we can make simple dashboards for understanding the data from Shodan. The main point of this talk is to show how we can enrich and visualize data from Shodan.
- Threat Hunting for IOCs with the Elastic Stack - Elastic(2022)
  - Elasticsearch provides various ways to collect and enrich data with threat intel feeds that can be used within the Elastic Security detection engine to help security analysts to detect alerts with threat indicator matching. In this meetup, we’ll provide an introduction to Cyber threat intelligence and demonstrate how Elastic provides an easy way to ingest Threat Intellingence feeds and build some robust cyber threat intelligence (CTI) capabilities.
Event Query Language
- 101
- Articles/Blogposts/Writeups
  - Introducing Event Query Language - Ross Wolf(2019)
  - The No Hassle Guide to Event Query Language (EQL) for Threat Hunting - Andy Green
- Talks/Presentations/Videos
  - Fantastic Red Team Attacks and How To Find Them - Casey Smith, Ross Wolf(BHUSA2019)
    - Slides
  - The Hunter Games: How to find the adversary with Event Query Language - Ross Wolf(CircleCityCon2019)
    - How do you find malicious activity? We often resort to the cliche, *you know it when you see it*, but how do you even *see it*, without drowning in data? MITRE’s ATT&CK knowledge base organizes adversary behavior into tactics and techniques, and orients our approach to endpoint data. It suggests questions that might be worth asking, but not a way to ask them. The Event Query Language (EQL) allows a security analyst to naturally express queries for IOC search, hunting, and behavioral detections, while remaining platform and data source agnostic. In this talk, I will demonstrate the iterative process of establishing situational awareness in your environment, creating targeted detections, and hunting for the adversary in your environment with real data, queries, and results.
  - Event Query Language (EQL): Detections in space and time - Elastic(2021)
    - Elastic has added a new query language to the stack designed to make it easier to see the flow of events and provide detection. EQL was originally developed by Endgame and now is part of the Stack after joining forces with Elastic. EQL provides us with a unique ability to look across our data in both the context of its time series flow, and the relationship between the events that lead to a positive detection. Join us as we explore this new powerful tool and how it gives every user a new edge.
- Tooling
  - EQL Analytics Library
    - The Event Query Language Analytics Library (eqllib) is a library of event based analytics, written in EQL to detect adversary behaviors identified in MITRE ATT&CK™.
  - Varna
    - Varna is an AWS serverless cloud security tool that parses and alerts on CloudTrail logs using Event Query Language (EQL). Varna is deployed as a lambda function, for scanning and serving web requests, and a dynamodb table, for keeping track of seen alerts. Varna is cheap & efficient to run, costing less than 15 dollars a month with proper configuration and ingesting alerts as soon as CloudTrail stores them in S3.
Tools
- Alerting
  - ElastAlert
    - ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch.
- Analysis
  - Dsiem
    - Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, and produces risk-adjusted alarms.
  - ee-outliers
    - Framework to easily detect outliers in Elasticsearch events.
- Automation
  - Vulcanizer
    - This project is a golang library for interacting with an Elasticsearch cluster. It's goal is to provide a high level API to help with common tasks that are associated with operating an Elasticsearch cluster such as querying health status of the cluster, migrating data off of nodes, updating cluster settings, etc.
- Ingestion
  - evtx2es
    - A library for fast parse & import of Windows Eventlogs into Elasticsearch.
  - pfelk
    - pfSense/OPNsense + Elastic Stack
- Interaction
  - dejavu
    - The Missing Web UI for Elasticsearch: Import, browse and edit data with rich filters and query views, create search UIs visually.
Writing Queries
- Using Auditbeat and ELK to monitor GTFOBins binaries. - In.Security(2019)
- Elasticsearch Queries: A Guide to Query DSL - Gedalyah Reback(2021)
Red ELK
- Introducing RedELK – Part 1: why we need it - Marc Smeets(2019)
  - RedELK Part 2 – getting you up and running
  - RedELK Part 3 – Achieving operational oversight
- Automating a RedELK Deployment Using Ansible - Jason Lang(2020)

Graylog

Setting up a lab
- No More Secrets: Logging Made Easy Through Graylog - VDA Labs

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

L-SM-TH.md

L-SM-TH.md

Logging(Host/Network) / Security Monitoring / Threat Hunting

Table of Contents

Agnostic

Network-based

Linux-based

Cloud-based

macOS-based

Windows-based

Data Storage & Analysis Stacks

ELK Stack

Graylog

Splunk

Files

L-SM-TH.md

Latest commit

History

L-SM-TH.md

File metadata and controls

Logging(Host/Network) / Security Monitoring / Threat Hunting

Table of Contents

Agnostic

Network-based

Linux-based

Cloud-based

macOS-based

Windows-based

Data Storage & Analysis Stacks

ELK Stack

Graylog

Splunk