Single-node Wazuh 4.12.0 stack deployed on the management segment of a multi-VLAN home SOC lab, with agents enrolled on a Windows domain controller and workstation, plus a custom MITRE ATT&...

Single-node Wazuh 4.12.0 stack deployed on the management segment of a multi-VLAN home SOC lab, with agents enrolled on a Windows domain controller and workstation, plus a custom MITRE ATT&...

A sample log generator that produces realistic ECS-format events simulating common APT techniques Example KQL and EQL detection rules covering credential dumping, encoded PowerShell, suspicious pro...

SOC home lab detecting APT28 credential dumping. Inspired by CERT-UA threat intelligence from the Russia-Ukraine war - batihroman/apt-detection-lab

Unsupervised anomaly detector that flags early breach precursors (credential dumping, process injection) using Isolation Forest on EDR-style process features. Inspired by CrowdStrike-style EDR — in...

Vendor-neutral Sigma detection rules across 9 MITRE ATT&CK tactics — credential dumping, encoded PowerShell, persistence, lateral movement, and more. Structurally validated in CI with an au...

Cloud-native threat hunting case study using Splunk Cloud to detect MITRE ATT&CK T1003.001 (LSASS Memory Dumping). Features custom SPL and runtime regex (rex) log parsing of raw Sysmon tele...

A structured DFIR playbook for analyzing memory dumps using Volatility 3. This repository provides a question-driven workflow for investigating volatile memory artifacts, suspicious processes, netw...