Awesome Threat Detection and Hunting

A curated list of awesome threat detection and hunting resources

Contents

• Threat Detection and Hunting
  • Tools
  • DataSet
  • Resources
    • Frameworks
    • DNS
    • Command and Control
    • Osquery
    • Windows
      • Sysmon
      • PowerShell
    • Research Papers
    • Blogs
  • Videos
  • Trainings
  • Twitter
• Threat Simulation
  • Tools
  • Resources
• Contribute
• License

Threat Detection and Hunting

Tools

• MITRE ATT&CK Navigator(source code) - The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in tools like Excel.
• HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
• osquery - An operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. It exposes an operating system as a high-performance relational database.
• osquery-configuration - A repository for using osquery for incident detection and response.
• DetectionLab - Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices.
• Sysmon-DFIR - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
• sysmon-config - Sysmon configuration file template with default high-quality event tracing.
• sysmon-modular - A repository of sysmon configuration modules. It also includes a mapping of Sysmon configurations to MITRE ATT&CK techniques.
• Revoke-Obfuscation - PowerShell Obfuscation Detection Framework.
• Invoke-ATTACKAPI - A PowerShell script to interact with the MITRE ATT&CK Framework via its own API.
• Unfetter - A reference implementation provides a framework for collecting events (process creation, network connections, Window Event Logs, etc.) from a client machine and performing CAR analytics to detect potential adversary activity.
• NOAH - PowerShell No Agent Hunting.
• PSHunt - Powershell Threat Hunting Module.
• Flare - An analytical framework for network traffic and behavioral analytics.
• go-audit - An alternative to the auditd daemon that ships with many distros.
• sqhunter - A simple threat hunting tool based on osquery, Salt Open and Cymon API.
• RedHunt-OS - A Virtual Machine for Adversary Emulation and Threat Hunting. RedHunt aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment.
• Oriana - Lateral movement and threat hunting tool for Windows environments built on Django comes Docker ready.
• JA3 - A method for profiling SSL/TLS Clients
• Bro-Osquery - Bro integration with osquery
• Brosquery - A module for osquery to load Bro logs into tables
• Kolide Fleet - A flexible control server for osquery fleets
• DeepBlueCLI - A PowerShell Module for Hunt Teaming via Windows Event Logs

Dataset

• SecRepo.com(github repo) - Samples of security related data.
• Boss of the SOC (BOTS) Dataset Version 1

Resources

• Huntpedia - Your Threat Hunting Knowledge Compendium
• Hunt Evil - Your Practical Guide to Threat Hunting
• The Hunter's Handbook - Endgame's guide to adversary hunting
• ThreatHunter-Playbook - A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
• The ThreatHunting Project - A great collection of hunts and threat hunting resources.
• CyberThreatHunting - A collection of resources for threat hunters.
• Hunt-Detect-Prevent - Lists of sources and utilities to hunt, detect and prevent evildoers.
• Alerting and Detection Strategy Framework
• A Framework for Cyber Threat Hunting (Part1, Part2, Part3)
• Common Threat Hunting Techniques & Datasets
• Generating Hypotheses for Successful Threat Hunting
• Expert Investigation Guide - Threat Hunting
• Active Directory Threat Hunting
• Threat Hunting for Fileless Malware
• Windows Commands Abused by Attackers
• JPCERT - Detecting Lateral Movement through Tracking Event Logs
• Tool Analysis Result Sheet
• Deception-as-Detection - Deception based detection techniques mapped to the MITRE’s ATT&CK framework.
• Deception, Breaches, and Going on the Offense to Seed the Hunt
• On TTPs
• Situational-Awareness Driven Threat Hunting
• Hunting On The Cheap (Part 1: The Architecture, Part 2: Hunting On Networks, Part 3: Hunting On Hosts, Slides)
• Threat Hunting Techniques - AV, Proxy, DNS and HTTP Logs
• Detecting Malware Beacons Using Splunk
• Flattened MITRE ATT&CK Matrix - It contains all matrix categories mapped to techniques with examples of application by software or threat actor groups.
• Data Science Hunting Funnel
• Use Python & Pandas to Create a D3 Force Directed Network Diagram
• Syscall Auditing at Scale
• Catching attackers with go-audit and a logging pipeline
• The Coventry Conundrum of Threat Intelligence
• Signal the ATT&CK: Part 1 - Building a real-time threat detection capability with Tanium that focuses on documented adversarial techniques.
• JA3: SSL/TLS Client Fingerprinting for Malware Detection
• SANS Summit Archives (DFIR, Cyber Defense) - Threat hunting, Blue Team and DFIR summit slides
• Bro-Osquery - Large-Scale Host and Network Monitoring Using Open-Source Software

Frameworks

• MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target.
• MITRE CAR - The Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) adversary model.
• Alerting and Detection Strategies Framework - A framework for developing alerting and detection strategies.
• A Simple Hunting Maturity Model - The Hunting Maturity Model describes five levels of organizational hunting capability, ranging from HMM0 (the least capability) to HMM4 (the most).
• The Pyramic of Pain - The relationship between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them.
• A Framework for Cyber Threat Hunting
• The PARIS Model - A model for threat hunting.
• Cyber Kill Chain - It is part of the Intelligence Driven Defense® model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective.
• The DML Model - The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks.
• Endgame Hunt Cycle
• NIST Cybersecurity Framework
• Sigma - Generic Signature Format for SIEM Systems

DNS

• Leveraging DNS to Surface Attacker Activity
• Detecting DNS Tunneling
• The Nuts and Bolts of Detecting DNS Tunneling
• Hunting the Known Unknowns (with DNS)
• Detecting dynamic DNS domains in Splunk
• Random Words on Entropy and DNS
• Tracking Newly Registered Domains
• Suspicious Domains Tracking Dashboard
• Proactive Malicious Domain Search
• Plight At The End Of The Tunnel
• DNS is NOT Boring - Using DNS to Expose and Thwart Attacks
• Actionable Detects - Blue Team Tactics

Command and Control

• The Hunter's Den: Command and Control
• Command-and-control Malware Traffic Playbook
• How to Hunt Command & Control Channels Using Bro IDS and RITA
• Detect Beaconing with Flare, Elastic Stack, and Intrusion Detection Systems
• Rise of Legitimate Services for Backdoor Command and Control

Osquery

• osquery Across the Enterprise
• osquery for Security — Part 1
• osquery for Security — Part 2 - Advanced osquery functionality, File integrity monitoring, process auditing, and more.
• Tracking a stolen code-signing certificate with osquery
• Monitoring macOS hosts with osquery
• Kolide's Blog
• The osquery Extensions Skunkworks Project

Mac

• Attacking a Mac: Detecting MacOS Post-Exploitation
• When Macs Come Under ATT&CK
• Hunting for Bad Apples — Part 1
• Hunting for Bad Apples — Part 2

Windows

• Threat Hunting via Windows Event Logs
• Windows Logging Cheat Sheets
• Active Directory Threat Hunting
• Windows Hunting - A collection of Windows hunting queries

Sysmon

• Splunking the Endpoint: Threat Hunting with Sysmon
  • Hunting with Sysmon
• Threat Hunting with Sysmon: Word Document with Macro
• Chronicles of a Threat Hunter: Hunting for In-Memory Mimikatz with Sysmon and ELK
  • Part I (Event ID 7)
  • Part II (Event ID 10)
• Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) (botconf 2016 Slides, FIRST 2017 Slides)
• The Sysmon and Threat Hunting Mimikatz wiki for the blue team
• Splunkmon — Taking Sysmon to the Next Level

• How to Go from Responding to Hunting with Sysinternals Sysmon
• Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk)

.NET

• Hunting For In-Memory .NET Attacks
• Detecting Malicious Use of .NET - Part 1
• Detecting Malicious Use of .NET – Part 2
• Implications of Loading .NET Assemblies

PowerShell

• Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science (Paper, Slides)
• Hunting the Known Unknowns (With PowerShell)
• HellsBells, Let's Hunt PowerShells!
• Hunting for PowerShell Using Heatmaps
• Powershell Download Cradles

Research Papers

• Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains
• The Diamond Model of Intrusion Analysis
• EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis
• A Comprehensive Approach to Intrusion Detection Alert Correlation (Paper, Dissertation)
• On Botnets that use DNS for Command and Control
• Intelligent, Automated Red Team Emulation

Blogs

• David Bianco's Blog
• sqrrl Hunting Blog
• DFIR and Threat Hunting Blog
• CyberWardog's Blog
• Chris Sanders' Blog
• Kolide Blog

Videos

• SANS Threat Hunting and IR Summit 2017
• SANS Threat Hunting and IR Summit 2016
• BotConf 2016 - Advanced Incident Detection and Threat Hunting using Sysmon and Splunk
• BSidesCharm 2017 - Detecting the Elusive: Active Directory Threat Hunting
• BSidesAugusta 2017 - Machine Learning Fueled Cyber Threat Hunting
• Toppling the Stack: Outlier Detection for Threat Hunters
• BSidesPhilly 2017 - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles
• Black Hat 2017 - Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
• DefCon 25 - MS Just Gave the Blue Team Tactical Nukes
• BSides London 2017 - Hunt or be Hunted
• SecurityOnion 2017 - Pivoting Effectively to Catch More Bad Guys
• SkyDogCon 2016 - Hunting: Defense Against The Dark Arts
• BSidesAugusta 2017 - Don't Google 'PowerShell Hunting'
• BSidesAugusta 2017 - Hunting Adversaries w Investigation Playbooks & OpenCNA
• Visual Hunting with Linked Data
• RVAs3c - Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary's Cost
• BSidesLV 2016 - Hunting on the Endpoint w/ Powershell
• Derbycon 2015 - Intrusion Hunting for the Masses A Practical Guide
• BSides DC 2016 - Practical Cyborgism: Getting Start with Machine Learning for Incident Detection
• SANS Webcast 2018 - What Event Logs? Part 1: Attacker Tricks to Remove Event Logs
• Profiling And Detecting All Things SSL With JA3
• QueryCon 2018 - An annual conference for the osquery open-source community (querycon.io)

Trainings

• Threat Hunting Academy
• SANS SEC555 - SIEM with Tactical Analytics.
• eLearnSecurity THP - Threat Hunting Professional
• SpecterOps Adversary Tactics: Detection

Twitter

• "Awesome Detection" Twitter List - Security guys who tweet about threat detection, hunting, DFIR, and red teaming
• "Awesome Detection" Collection - A collection of tweets about threat detection, hunting, DFIR, and read teaming techniques that can help you create detection logics.
• Top #infosec Twitter Accounts (From a Threat Hunter’s Perspective)

Threat Simulation

A curated list of awesome adversary simulation resources

Tools

• MITRE CALDERA - An automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks.
• APTSimulator - A Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.
• Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework.
• Network Flight Simulator - flightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
• Metta - A security preparedness tool to do adversarial simulation.
• Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
• SharpShooter - Payload Generation Framework.
• CACTUSTORCH - Payload Generation for Adversary Simulations.
• DumpsterFire - A modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events.
• Empire(website) - A PowerShell and Python post-exploitation agent.
• PowerSploit - A PowerShell Post-Exploitation Framework.
• RedHunt-OS - A Virtual Machine for Adversary Emulation and Threat Hunting. RedHunt aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment.

Resources

• MITRE's Adversary Emulation Plans
• Awesome Red Teaming - A list of awesome red teaming resources
• Red-Team Infrastructure Wiki - Wiki to collect Red Team infrastructure hardening resources.
• Payload Generation using SharpShooter
• SpecterOps Blog
• Advanced Threat Tactics - A free course on red team operations and adversary simulations.
• Signal the ATT&CK: Part 1 - Modelling APT32 in CALDERA
• Introducing Endgame Red Team Automation
• Red Teaming/Adversary Simulation Toolkit - A collection of open source and commercial tools that aid in red team operations.

Contribute

Contributions welcome! Read the contribution guidelines first.

License

To the extent possible under law, Adel "0x4D31" Karimi has waived all copyright and related or neighboring rights to this work.