Thread by @Kostastsale

1/ I am taking a little break but couldn’t resist checking-out my favourite open-source projects for any updates. Doing so, I thought it will be useful to share my top 10 projects that anyone in the #infosec field should know about. Here they are 🧵:

2/ 📊 HELK (buff.ly/3BHn9iR): The Hunting ELK (HELK) project provides an analytics and threat hunting platform for security teams to identify and respond to threats in their environment. Just load your logs and start hunting! #HELK #ThreatHunting

3/ 🔍 Sigma(buff.ly/3q12WOC ): Sigma enables infosec peeps to create rules for SIEM systems for detecting and responding to security incidents. It also allows us to share our rules in a non-vendor-specific format! Free detections anyone!?! #Sigma #SIEM

4/ 🤖 Caldera (buff.ly/3pTdLGe): Caldera is an automated adversary emulation system that performs post-compromise adversarial behaviour within networks, giving blue teams realistic attack scenarios for training and response planning.  #Caldera #AdversaryEmulation

5/  🛡️ DetectionLab (buff.ly/2EsdykJ): Although not actively maintained, DetectionLab can still be used to automate the setup of a small network for simulating real-world attack scenarios and to test blue team detection capabilities. #DetectionLab #NetworkSecurity

6/  💥 Atomic Red Team (buff.ly/3u6iiSC): A library of tests mapped to the MITRE ATT&CK® framework, allowing security teams to quickly, portably, and reproducibly test their environments against known attack techniques.  #AtomicRedTeam #MITREATTACK

7/  🚗 LOLDrivers (buff.ly/3pTPpMx ): This project compiles vulnerable, malicious, and known malicious Windows drivers in one repository, helping security teams understand and defend against Living Off The Land attacks. #LOLDrivers #WindowsSecurity

8/  📚 LOLBAS (buff.ly/3MBO4TG): The LOLBAS project aims to document every binary, script, and library that can be used for #LivingOffTheLand techniques, providing valuable knowledge for blue teams to better detect and defend against such attacks.  #LOLBAS

9/  🛡️ UnProtect Project (buff.ly/3WhZnDU): UnProtect focuses on classifying evasion techniques to better understand and analyze malware, aiding blue teams in strengthening their detection capabilities against such techniques. #UnProtect #MalwareAnalysis

10/ 📚 MSTICpy (buff.ly/34wem2P): A powerful library for investigations & hunting in Jupyter Notebooks.  Features include querying logs, Threat Intel enrichment, advanced analysis & interactive visualizations.#JupyterNotebooks

11/ 📊 EDR-Telemetry (buff.ly/41L5tOe): Shameless plug of a project of mine that compares & evaluates the telemetry of various EDR products, helping security teams choose the right #EDR solution for their orgs and enhance their telemetry visibility.  #EndpointSecurity

12/  🎯 These are my top 10 blue team's most valuable projects. Some of the ones I mentioned are new, and others have been around for some time.

Regardless, they taught me a lot, and I am grateful to anyone who has contributed to these projects!

/end I will also be making a list of the top 10 tools soon. Be sure to check them out and contribute to the open-source community!  #InfoSec #GitHub