threathunting
Incident-Playbook
Our great sponsors
| threathunting | Incident-Playbook | |
|---|---|---|
| 3 | 10 | |
| 1,102 | 1,329 | |
| - | - | |
| 1.7 | 0.0 | |
| 9 months ago | over 1 year ago | |
| Python | Python | |
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
threathunting
-
Breaking down MITRE ATT&CK for ICS techniques into MON Requirements?
Olaf has a Splunk module for 'threat hunting' that's mapped to the Enterprise Mitre framework, might be a good example for some components - https://github.com/olafhartong/ThreatHunting - Note: If you just blindly install it... It's pretty rough on the search head...
-
How to extract hash value from hashes field from sysmon log.
Well i'm working with this ThreatHunting app (https://github.com/olafhartong/ThreatHunting) basicly we utilize Mitre Attack framework to create sysmon rule in order to detect malwares and attacks on your computer. I'm trying to create a custom script scan the process hashes to check weather it is a threat or not cause
-
How to extract
ThreatHunting app: https://github.com/olafhartong/threathunting/
Incident-Playbook
- Cyber Playbooks
- Goal: Incident Response Playbooks Mapped to Mitre Attack Tactics and Techniques
- austinsonger/Incident-Playbook - Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]
- Github Incident Playbooks "Incident Response Process and Playbooks | Goal: Playbooks to be Mapped to MITRE Attack Techniques"
- Github: austinsonger/Incident-Playbooks "Incident Response Process and Playbooks | Goal: Playbooks to be Mapped to MITRE Attack Techniques"
- Incident Response Process and Playbooks Mapped to Mitre Attack Technique
- Incident Response Process and Playbooks
What are some alternatives?
sysmon-modular - A repository of sysmon configuration modules
atomic-red-team - Small and highly portable detection tests based on MITRE's ATT&CK.
splunk-connect-for-syslog - Splunk Connect for Syslog
ansible-navigator - A text-based user interface (TUI) for Ansible.
splunk-spl - SPL cheatsheet for Splunk.
caldera - Automated Adversary Emulation Platform
threathunting-spl - Splunk code (SPL) for serious threat hunters and detection engineers.
EDR-Testing-Script - Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads
hashlookup-forensic-analyser - Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/
Incident-Response-Playbooks
ChatGPT-4-Splunk - Splunk TA for sending completion requests to ChatGPT
content - Demisto is now Cortex XSOAR. Automate and orchestrate your Security Operations with Cortex XSOAR's ever-growing Content Repository. Pull Requests are always welcome and highly appreciated!