Self-hosted Windows EDR for infostealers, ransomware, credential dumping and persistence. Rust agent with on-device detection and containment, web console, remote response. - lawbyte/kestrel-edr

A full Active Directory penetration test report on a lab domain (test.local), covering the complete attack chain from initial foothold to Domain Admin via enumeration, Kerberoasting, and credential...

A sample log generator that produces realistic ECS-format events simulating common APT techniques Example KQL and EQL detection rules covering credential dumping, encoded PowerShell, suspicious pro...

Vendor-neutral Sigma detection rules across 9 MITRE ATT&CK tactics — credential dumping, encoded PowerShell, persistence, lateral movement, and more. Structurally validated in CI with an au...