The Threat Hunter Playbook
0
Free
The Threat Hunter Playbook is a community-driven, open source project to share detection logic, adversary tradecraft, and resources to make detection development more efficient. All the detection documents in this project follow the structure of MITRE ATT&CK, categorizing post-compromise adversary behavior in tactical groups and are available in the form of interactive notebooks. The use of notebooks allows sharing text, queries, expected output, and code to help others run detection logic against pre-recorded security datasets locally or remotely through BinderHub cloud computing environments. The project aims to expedite the development of techniques and hypotheses for hunting campaigns, help security researchers understand patterns of behavior observed during post-exploitation, share resources to validate analytics, map pre-recorded datasets to adversarial techniques, and accelerate infosec learning through open source resources.
FEATURES
The author has not provided features for this tool yet. If you are the author, please sign in or claim the tool to add features by clicking the icon above.
ALTERNATIVES
The Ransomware Tool Matrix is a repository that lists and categorizes tools used by ransomware gangs, aiding in threat hunting, incident response, and adversary emulation.
Provides breach and attack simulation products for security control validation, offering three different products to meet the needs of organizations of various sizes and maturity levels.
Commercial
Robust Python SDK and Command Line Client for interacting with IntelOwl's API.
A visualization tool for threat analysis that organizes APT campaign information and visualizes relations of IOC.
Tool for visualizing correspondences between YARA ruleset and samples
Maldatabase is a threat intelligence platform providing malware datasets and threat intelligence feeds for malware data science and threat intelligence.
A cybersecurity tool with online demo, mailing list, and multiple installation methods.
A threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel
PINNED
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Free
Security Operations
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
Free
Blogs and News
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Commercial
Cloud Security
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.
Commercial
AI Security