jsecurity101/TelemetrySource

Stars
189
Rank 204,649 (Top 5 %)
Language
License
GNU General Publi...
Created about 2 years ago
Updated almost 2 years ago

jsecurity101/TelemetrySource

jsecurity101

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

TelemetrySource

Project created to map functions repsonsible for triggering events from various telemetry sources.

Main Mapping Sheet: Event Mapping Google Sheet

Currently mapped sources:

Sysmon

Window Security Events (Microsoft-Windows-Security-Auditing)

Each source has it's own README file with the necessary information needed to understand how the mappings work.

Feedback:

If anyone has suggestions on how this data could be exposed differently to better help defenders or any other feedback, please reach out! The goal with this project is to help defenders understand how data is generated, so that we can be more informed in our decisions when leveraging that data.

To-Dos:

Update Sysmon to v14
Expand events in Microsoft-Windows-Security-Auditing

MSRPC-to-ATTACK

A repository that maps commonly used attacks using MSRPC protocols to ATT&CK

Marvel-Lab

A collection of Powershell scripts that will help automate the build process for a Marvel domain.

JonMon

Windows-API-To-Sysmon-Events

A repository that maps API calls to Sysmon Event ID's.

PowerParse

PowerShell PE Parser

RandomPOCs

Repo that holds random POCs

Detecting-Process-Injection-Techniques

This is a repository that is meant to hold detections for various process injection techniques.

Jupyter Notebook

LDAPMon

Automated-Detection-Pipeline

Jupyter Notebook

jsecurity101

Import-Marvel

Powershell script and CSV file that allows you to import marvel characters into Active Directory

ApacheGuacamole

Install Script for ApacheGuacamole

VulnerableService

Powershell script to create a vulnerable service, that can be easily used for privilege escalation

ProcCallback

An example of how a driver can register a handle creation callback.

Presentations

Python-Socket-Chat-room

Created a chat room in socket python

WinDbg-Scripts

Repository that holds WinDbg scripts that I have created to help with various tasks.

Python-Port-Scanner

Import-LOTR

Powershell script and CSV file that allows you to import characters from Lord of the Rings as Users, into Active Directory

IPC-Mechanisms