The ThreatHunter-Playbook
A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns by leveraging security event logs from diverse operating systems. This project provides specific chains of events exclusively at the host and network level so that you can take them and develop logic to develop data analytics in your preferred tool or query format. This repo follows the structure of the MITRE ATT&CK framework categorizing post-compromise adversary behavior in tactical groups.
In addition, the project documents detection strategies in the form of interactive notebooks to provide an easy and flexible way to visualize the expected output and be able to run the analytics against pre-recorded mordor datasets through BinderHub cloud computing environments.
Goals
- Expedite the development of techniques an hypothesis for hunting campaigns.
- Help Threat Hunters understand patterns of behavior observed during post-exploitation.
- Reduce the number of false positives while hunting by providing more context around suspicious events.
- Share real-time analytics validation examples through cloud computing environments for free.
- Distribute Threat Hunting concepts and processes around the world for free.
- Map pre-recorded datasets to adversarial techniques.
Author
- Roberto Rodriguez @Cyb3rWard0g
- Jose Luis Rodriguez @Cyb3rPandaH
Contributing
Can't wait to see other hunters' pull requests with awesome ideas to detect advanced patterns of behavior. The more chains of events you contribute the better this playbook will be for the community.
- Submit Pull requests following the TEMPLATE format.
- Highly recommend to test your chains of events or provide references to back it up before submitting a pull request (Article, whitepaper, hunter notes, etc).
- Hunter notes are very useful and can help explaining why you would hunt for specific chains of events.
- Feel free to submit pull requests to enhance hunting techniques. #SharingIsCaring
To-Do
- OSX & Linux Playbooks
- Cloud AWS Playbooks
- Update Binder Libraries (Testing)