The Threat Hunter Playbook
The Threat Hunter Playbook is a community-driven, open source project to share detection logic, adversary tradecraft, and resources to make detection development more efficient. All the detection documents in this project follow the structure of MITRE ATT&CK, categorizing post-compromise adversary behavior in tactical groups and are available in the form of interactive notebooks. The use of notebooks allows sharing text, queries, expected output, and code to help others run detection logic against pre-recorded security datasets locally or remotely through BinderHub cloud computing environments. The project aims to expedite the development of techniques and hypotheses for hunting campaigns, help security researchers understand patterns of behavior observed during post-exploitation, share resources to validate analytics, map pre-recorded datasets to adversarial techniques, and accelerate infosec learning through open source resources.
FEATURES
ALTERNATIVES
A summary of the threat modeling posts and final thoughts on the process
A Linux distribution designed for threat emulation and threat hunting, integrating attacker and defender tools for identifying threats in your environment.
A list of most queried domains based on passive DNS usage across the Umbrella global network.
Repository for detection content with various types of rules and payloads.
RogueApps is a collaborative repository documenting TTPs of malicious OIDC/OAuth 2.0 applications for cybersecurity research and awareness.
Utilize Jupyter Notebooks to enhance threat hunting capabilities by focusing on different threat categories or stages.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.