Full build-and-attack writeup for a self-hosted AD lab: domain controller setup, realistic domain population, then a full attack chain against it, SMB/LDAP enumeration, Kerberoasting and ASREPRoast...

A sample log generator that produces realistic ECS-format events simulating common APT techniques Example KQL and EQL detection rules covering credential dumping, encoded PowerShell, suspicious pro...

SOC home lab detecting APT28 credential dumping. Inspired by CERT-UA threat intelligence from the Russia-Ukraine war - batihroman/apt-detection-lab

Unsupervised anomaly detector that flags early breach precursors (credential dumping, process injection) using Isolation Forest on EDR-style process features. Inspired by CrowdStrike-style EDR — in...

TryHackMe SOC Level 1 — Full kill chain analysis: HTA lure, DLL execution, credential dumping, DCSync, ransomware staging - czabatta/THM-Boogeyman3

A structured DFIR playbook for analyzing memory dumps using Volatility 3. This repository provides a question-driven workflow for investigating volatile memory artifacts, suspicious processes, netw...