This is your work, valued

Brendan Chamberlain

Expert
@infosecB

Threat Detection Engineer | detection & response | automation | macOS security | awesome-detection-engineering, LOOBins, Rulehound

awesome-detection-engineering. Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

1.3k

LOOBins. Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

539

Rulehound. An index of publicly available and open-source threat detection rulesets.

136

detection-as-code. An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.

61

normalize-atp-safelink. Python script that normalizes a URL that has been rewritten by Microsoft ATP SafeLink protection.

7

generate_attacknav_layer. A Python CLI utility for quickly converting a list or text file of MITRE ATT&CK technique IDs to a MITRE ATT&CK Navigator layer .JSON file.

4

auditd-ripper. Python CLI for normalizing, aggregrating, and decoding auditd logs.

3

detection-engineering-ai-maturity. A community framework for assessing AI/LLM use across a detection engineering program.

3

bluecoat-webpulsir. Check and submit Blue Coat WebPulse website classifications.

2

awesome. 😎 Awesome lists about all kinds of interesting topics

1

disable-remote-nic. A PowerShell script for remotely disabling active Windows 10/2016 device network interfaces.

1

awesome-threat-detection. A curated list of awesome threat detection and hunting resources

1

pydantic-attack. Python

1

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

1

security_content. Splunk Security Content

1

generative-ai-for-beginners. 12 Lessons, Get Started Building with Generative AI 🔗 https://microsoft.github.io/generative-ai-for-beginners/

1

infosecb.

1

PySPL. A lightweight Python library that allows you to run Splunk SPL (Search Processing Language) queries against Python dictionaries and lists. No Splunk installation required!

1

personal-claude-plugins. A marketplace of personal plugins for Claude Code and Cowork (Claude Desktop).

1