Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Windows Events Attack Samples

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

A curated knowledge base to build, run and mature a SOC (including CSIRT).

Awesome Security lists for SOC/CERT/CTI

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

Splunk Security Content

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.

A resource containing all the tools each ransomware gangs uses

Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

Pipelined Query Language

Awesome list of keywords and artifacts for Threat Hunting sessions

MCP to help Defenders Detection Engineer Harder and Smarter

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.

Misc Threat Hunting Resources

Threatest is a CLI and Go framework for end-to-end testing threat detection rules.