SOC home lab detecting APT28 credential dumping. Inspired by CERT-UA threat intelligence from the Russia-Ukraine war - batihroman/apt-detection-lab

Jarvis Global Secure Encrypted Credential Vault — AES-GCM + PBKDF2 加密存储池，含安全鉴证（ACL/意图/弱口令/模块完整性）与快照回滚 - RockiChn/credential-vault

Unsupervised anomaly detector that flags early breach precursors (credential dumping, process injection) using Isolation Forest on EDR-style process features. Inspired by CrowdStrike-style EDR — in...

Vendor-neutral Sigma detection rules across 9 MITRE ATT&CK tactics — credential dumping, encoded PowerShell, persistence, lateral movement, and more. Structurally validated in CI with an au...

TryHackMe SOC Level 1 — Full kill chain analysis: HTA lure, DLL execution, credential dumping, DCSync, ransomware staging - czabatta/THM-Boogeyman3

Cloud-native threat hunting case study using Splunk Cloud to detect MITRE ATT&CK T1003.001 (LSASS Memory Dumping). Features custom SPL and runtime regex (rex) log parsing of raw Sysmon tele...

A structured DFIR playbook for analyzing memory dumps using Volatility 3. This repository provides a question-driven workflow for investigating volatile memory artifacts, suspicious processes, netw...

Built an enterprise SOC homelab using ELK Stack, Active Directory, Sysmon, and Winlogbeat for centralized log monitoring and threat detection. Simulated real-world attacks including brute force, re...

Hands-on Endpoint Detection & Response (EDR) lab using LimaCharlie to simulate and investigate LSASS credential dumping activity, endpoint telemetry, and SOC investigation workflows. - omcy...

Simulated internal Active Directory penetration test demonstrating enumeration, lateral movement, credential dumping, and full domain compromise in a VMware lab environment. - JOHNNY210702/Pentest-...

Critical concepts demonstrated: Kerberoasting, AS-REP roasting, DCSync BloodHound attack path analysis Lateral movement (PSExec, WMI, WinRM) Credential dumping (LSASS, SAM) - vetementsvmnts/-Active...

A structured DFIR playbook for analyzing memory dumps using Volatility 3. This repository provides a question-driven workflow for investigating volatile memory artifacts, suspicious processes, netw...

Windows 10 exploitation and privilege escalation lab using SMB enumeration, remote command execution, credential dumping, and NTLM hash cracking. - ajx77/Windows10-Privilege-Escalation-Lab

End-to-end incident response simulation: T1003.001 LSASS credential dumping detection & remediation with Wazuh SIEM and formal incident report - gaurav-koshti-CySA/Incident-Response-lab

This repository is my university project about simulating credential dumping and privilege escalation in a Windows Active Directory environment - KiMiRoTa/Windows-10-Crendential-Attack-Pentesting

Built and exploited a self-hosted Active Diretory Lab Simulation real-world attack scenarios including enumeration, lateral movement, and credential dumping. - ajx77/Active-Directory-Pentest-Lab

Built and validated a Splunk detection for PowerShell or cmd activity executing from or referencing a temporary directory where the command line references an LSASS dump file (lsass.DMP). This beh...

This repository is my university project about simulating credential dumping and privilege escalation in a Windows Active Directory environment - KiMiRoTa/Windows-10-Crendential-Attack-Pentesting

This repository is my university project about simulating credential dumping and privilege escalation in a Windows Active Directory environment - KiMiRoTa/Windows-10-Credential-Attack-Pentesting