DetectionLabELK

DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts.

https://github.com/cyberdefenders/DetectionLabELK

#blueteam #detection #elk #lab

MAL-CL — Malicious Command-Line

MAL-CL aims to collect and document real world and most common "malicious" command-line executions of different tools and utilities while providing actionable detections and resources for the blue team.

https://github.com/3CORESec/MAL-CL

#windows #cli #detection #blueteam #redteam

Detecting NTLM Relay Attacks

https://posts.bluraven.io/detecting-ntlm-relay-attacks-d92e99e68fb9

#detection #ntlm #relay #blueteam

Important Windows processes for Threat Hunting

https://www.socinvestigation.com/important-windows-processes-for-threat-hunting/

#edr #detection #forensic #process

🛡 On Detection: Tactical to Functional

The goal of this series is to facilitate a conversation about the more technical aspects of attacks and how a deeper understanding at the more foundational levels helps to provide a batter base to build assumptions from.

🔗 Part 1: Discovering API Function Usage through Source Code Review
🔗 Part 2: Operations
🔗 Part 3: Expanding the Function Call Graph

#maldev #pinvoke #winapi #detection #blueteam #ttp

📄 Detecting ADCS Web Services Abuse (ESC8)

One of the popular attack vectors against Active Directory Certificate Services is ESC8. This article covers detecting irregular access to some ADCS web services exposed, as well as detecting the NTLM relaying itself.

https://medium.com/falconforce/falconfriday-detecting-adcs-web-services-abuse-0xff20-9f660c83cb36

#adcs #detection #esc8 #blueteam