payaljaiswani Goto Github PK

lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

malware

Course materials for Malware Analysis by RPISEC

microsoft-365-defender-hunting-queries

Sample queries for Advanced hunting in Microsoft 365 Defender

microsoft-defender-security-center-hunting-queries

Hunting Queries for Microsoft Defender Security Center https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview

msbuildshell

MSBuildShell, a Powershell Host running within MSBuild.exe

msticpy

Microsoft Threat Intelligence Security Tools

notes-interview-google

process-hollowing

Great explanation of Process Hollowing (a Technique often used in Malware)

rulemigration

sentinel-attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

sentinel-queries

Collection of KQL queries

sentinelplaybooks

Azure Sentinel Playbooks

sigma

Generic Signature Format for SIEM Systems

signature-base

Yara detection

simuland

Understand adversary tradecraft and improve detection strategies

spl-to-kql

The idea is simply to save some quick notes that will make it easier for Splunk users to leverage KQL (Kusto), especially giving projects requiring both technologies (Splunk and Azure/Sentinel) or any other hybrid environments. Feel free to add/suggest entries.

splunkqueries

A list of Splunk queries that I've collected and used over time.

sysmon_to_advancedhunting_kql

threat-hunting-and-detection

threathunter-playbook

A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

threathunting

An informational repo about hunting for adversaries in your IT environment.

threathunting-1

Tools for hunting for threats.