DETECT – NetwerkLABS

Detection Engineering: An Introduction

Detection Engineering As cybersecurity environments continue to evolve, adversaries are becoming increasingly sophisticated, making cyber threats more frequent and difficult to detect. To keep pace with this changing landscape, organizations must adopt proactive security practices and…

Bharath Narayanasamy detection_engineering

Threat Hunting DETECT MITRE ATT&CK

Using MITRE ATT&CK Navigator to Strengthen Threat Modelling [PART: II]

🎯 A Hands-On, Step-by-Step Walkthrough 📚 1. Why Map a Threat Group at All? A threat model that stops at "we might get hacked" is not much use. ATT&CK lets you say something far more specific:…

Bharath Narayanasamy

Threat Hunting DETECT Detection Engineering

8 LOLBins Every Threat Hunter Should Know

🕵️‍♂️ 8 Key LOLBins and Hunting Them with Elastic Security 🎯 Attackers love tools that are already installed, already signed and already trusted. This post walks through the eight Windows binaries that showed up most often…

Bharath Narayanasamy LOLBINs

DETECT ATTACK Detection Engineering

Living Off the Land (LOTL) Resources

🌿 Living Off the Land (LOTL) Resources 🗺️ 🎯 Attackers don't always bring their own tools. Sometimes the best weapon is already sitting on the machine. This guide walks through a well-organized collection of Living Off…

Bharath Narayanasamy LOLBINs, LOTL

DETECT DFIR

Volatility3: Memory Forensics Cheatsheet

VOLATILITY 3 Memory Forensics Investigation Cheatsheet DFIR | Detection Engineering | Threat Hunting | CyberDefenders Labs 01 │ SETUP & FUNDAMENTALS # Install via pip pip install volatility3 # Or clone from GitHub git clone https://github.com/volatilityfoundation/volatility3.git…

Bharath Narayanasamy Volatility

DETECT Purple Teaming Detection Engineering

Misbehaving binaries: Hunting LOLBins

🕵️‍♂️ Detection Engineering: Catching jsc.exe Abuse (T1127) 🟣 Technique: Trusted Developer Utilities Proxy Execution (MITRE ATT&CK T1127)🔵 Tool abused: jsc.exe, the Microsoft JScript .NET compiler🟢 Stack: Atomic Red Team ➜ Sysmon ➜ Elastic Agent ➜ Elastic…

Bharath Narayanasamy LOLBINs

Threat Hunting DETECT MITRE ATT&CK

Using MITRE ATT&CK Navigator to Strengthen Threat Modelling [PART: I]

Getting More Out of MITRE ATT&CK in Threat Modelling MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an openly available knowledge base describing how cyber adversaries behave. The MITRE Corporation maintains it. Organisations use it…

Bharath Narayanasamy ATT&CK, MITRE

DETECT Purple Teaming

Testing Your Defences: TTP Simulation with Atomic Red Team

Every organisation with a SIEM, an EDR agent and an identity platform believes it would notice an attack. Few have checked. Atomic Red Team is a free, community-maintained set of short scripts that lets you check.…

Bharath Narayanasamy caldera

LEARNING PATHS Wazuh SIEM & XDR DETECT

Importing the Wazuh 5.0 Beta OVA into Proxmox

Wazuh 5.0 is currently in beta, and the project also ships it as a ready-to-run OVA appliance. That's convenient if you just want to kick the tyres on the new release, but Proxmox doesn't import OVAs…

Bharath Narayanasamy SIEM, wazuh, EDR, XDR

EDR | SIEM | SOAR LEARNING PATHS Wazuh SIEM & XDR

Exploring Wazuh: Introduction

Introduction The Wazuh Agent At the heart of every monitored endpoint sits the Wazuh agent — a lightweight, cross-platform component that acts as your eyes and ears on the systems you care about. Once deployed, it…

Bharath Narayanasamy wazuh