EDR-style hunting detections against real Sysmon telemetry — encoded PowerShell, LOLBin abuse, Office-to-shell spawn chains, LOLBin C2 beaconing, DNS tunneling via entropy, and LSASS credential-dum...

Windows endpoint threat investigations covering DLL hijacking, PowerShell abuse, LSASS credential dumping, suspicious process relationships, and detection logic. - donmal/Windows-Endpoint-Threat-De...

Sigma rules for LSASS credential dumping (T1003.001) with a replay test, KQL/Splunk conversions, and APT41 coverage against ATT&CK v20 - Gursimran555/apt41-lsass-detections

Self-hosted Windows EDR for infostealers, ransomware, credential dumping and persistence. Rust agent with on-device detection and containment, web console, remote response. - lawbyte/kestrel-edr

A full Active Directory penetration test report on a lab domain (test.local), covering the complete attack chain from initial foothold to Domain Admin via enumeration, Kerberoasting, and credential...

End-to-End CSIRT Case Study & Automated Triage Engine: Analyzing a ClickFix -> PowerShell -> LummaC2 Infostealer & LSASS Credential Dumping Intrusion. - j03w1/CSIRT-Ca...

Simulating and detecting LSASS memory credential dumping techniques - omar-alghamdi-tech/lsass-credential-dumping-lab

End-to-end SIEM deployment with custom detection rules for LSASS credential dumping (MITRE T1003.001) - yusuf-aq/lsass-Detection-Lab

Custom Sysmon configuration built to detect a simulated 6-stage attack chain — credential dumping, ransomware file drops, persistence, and C2 activity. - gowtham526/Endpoint-Detection-and-Response-Lab

Single-node Wazuh 4.12.0 stack deployed on the management segment of a multi-VLAN home SOC lab, with agents enrolled on a Windows domain controller and workstation, plus a custom MITRE ATT&...

Single-node Wazuh 4.12.0 stack deployed on the management segment of a multi-VLAN home SOC lab, with agents enrolled on a Windows domain controller and workstation, plus a custom MITRE ATT&...

A sample log generator that produces realistic ECS-format events simulating common APT techniques Example KQL and EQL detection rules covering credential dumping, encoded PowerShell, suspicious pro...

SOC home lab detecting APT28 credential dumping. Inspired by CERT-UA threat intelligence from the Russia-Ukraine war - batihroman/apt-detection-lab

Unsupervised anomaly detector that flags early breach precursors (credential dumping, process injection) using Isolation Forest on EDR-style process features. Inspired by CrowdStrike-style EDR — in...

Vendor-neutral Sigma detection rules across 9 MITRE ATT&CK tactics — credential dumping, encoded PowerShell, persistence, lateral movement, and more. Structurally validated in CI with an au...

Cloud-native threat hunting case study using Splunk Cloud to detect MITRE ATT&CK T1003.001 (LSASS Memory Dumping). Features custom SPL and runtime regex (rex) log parsing of raw Sysmon tele...

A structured DFIR playbook for analyzing memory dumps using Volatility 3. This repository provides a question-driven workflow for investigating volatile memory artifacts, suspicious processes, netw...