The Threat Hunter Playbook Logo

The Threat Hunter Playbook

0
Free
Visit Website

The Threat Hunter Playbook is a community-driven, open source project to share detection logic, adversary tradecraft, and resources to make detection development more efficient. All the detection documents in this project follow the structure of MITRE ATT&CK, categorizing post-compromise adversary behavior in tactical groups and are available in the form of interactive notebooks. The use of notebooks allows sharing text, queries, expected output, and code to help others run detection logic against pre-recorded security datasets locally or remotely through BinderHub cloud computing environments. The project aims to expedite the development of techniques and hypotheses for hunting campaigns, help security researchers understand patterns of behavior observed during post-exploitation, share resources to validate analytics, map pre-recorded datasets to adversarial techniques, and accelerate infosec learning through open source resources.

FEATURES

ALTERNATIVES

Gathers Threat Intelligence Feeds from publicly available sources and provides detailed output in CSV format.

Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.

Automated framework for collecting and processing samples from VirusTotal with YARA rule integration.

A parsing tool for Yara Scan Service's JSON output file to help maximize benefits and automate parsing of Yara Scan Service results.

A project focusing on understanding and combating threats to the Internet economy and net citizens.

Cisco Umbrella is a cloud security platform that offers protection against threats on the internet by blocking malicious activity.

Facilitating exchange of information and knowledge to collectively protect against cyberattacks.

CAPEC™ is a comprehensive dictionary of known attack patterns used by adversaries to exploit weaknesses in cyber-enabled capabilities.

PINNED