Popular repositories Loading

1. ad-kerberos-attack-detection-soar ad-kerberos-attack-detection-soar Public

   Enterprise Active Directory threat detection & SOAR pipeline. Correlates Kerberoasting & AS-REP Roasting via Wazuh SIEM, featuring automated identity containment (LDAP bitwise UAC disable) & real-t…

   Python

2. canary-ransomware-triage canary-ransomware-triage Public

   Automated ransomware detection & live memory triage pipeline. Leverages Sysmon Event 11 canary file traps, P/Invoke NtSuspendProcess immediate thread freezing, automated ProcDump memory acquisition…

   PowerShell

3. lateral-movement-host-isolation lateral-movement-host-isolation Public

   Active Directory lateral movement defense pipeline. Detects WMI/WinRM remote LOLBin execution via Sysmon Event 1, dynamically resolves attacker IP via Security Event 4624 correlation, and enforces …

   PowerShell

4. ad-threat-detection-and-response-lab ad-threat-detection-and-response-lab Public

   Multi-scenario Active Directory detection and response lab covering Kerberos attacks, lateral movement, and ransomware triage.

   PowerShell

5. wazuh-detection-quality-lab wazuh-detection-quality-lab Public

   Python