Detection Defense Library

One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo.

This repo folds in five former sibling repositories:

The problem this solves

Detection engineering knowledge is split across patterns, Sigma rules, trust-boundary models, and tooling with no single spine. This repo fuses them: for any attack class you get the model of how the attack works, the observable to watch, the committed Sigma rules that catch it, and the harden/isolate/evict path. It is the inverse of HackTricks: a defense encyclopedia instead of an offense dump.

Quick start (it is a reference; nothing to install)

git clone [email protected]:WattoCyber/detection-defense-library.git
cd detection-defense-library

# 1. start by attack class (the fused view)
less classes/c01-uac-bypass.md # e.g. UAC bypass

# 2. or browse by continent / platform
less CONTINENTS.md

# 3. or find a technique
less TECHNIQUE-INDEX.md

Each classes/cN-*.md page is end-to-end: model, harden, detect, hunt, isolate, deceive, evict, restore, plus the Sigma rule IDs to enable first. Start at INDEX.md to see the full class map, then classes/_TEMPLATE.md for the contract every page follows.

Layout

• classes/ - browse by attack class (the fused view). One file per class is the end-to-end defense page (model through restore). Inventory counts live in INDEX.md.
• patterns/ - methodology patterns (p01-p11, p14-p34).
• CONTROL-MAP.md - ATT&CK mitigations / D3FEND / CIS / NIST overlay.
• METHODOLOGY.md - the detection development workflow.
• boundaries/ - Windows trust-boundary docs (b01 services..b10 token integrity).
• TRUST-MODEL.md - the trust-boundary synthesis model.
• drivers/ - the driver attack-surface: 661 dated driver records, BYOVD CVE catalog, HVCI + vulnerable-driver blocklist, and the detection map.
• splunk/ - the Splunk reference: SPL fundamentals, detection and alerting, Enterprise Security, and investigation patterns.
• sigma/ - the full Sigma corpus, indexed by MITRE ATT&CK technique and tactic (INDEX.md, TACTICS.md, DETECTION-GAPS.md).
• LIBRARY-GAPS.md - library-shape gaps vs a full defense encyclopedia (the antithesis of HackTricks). Rule-count gaps stay in sigma/DETECTION-GAPS.md.
• CONTINENTS.md - platform → primitive → page (the HackTricks spine).
• TECHNIQUE-INDEX.md - ATT&CK technique → fused class.
• classes/_TEMPLATE.md - done-definition for a fused class page (model, harden, detect, hunt, isolate, deceive, evict, restore).
• Continents (ad/, linux/, macos/, identity/, cloud/, email/, web/, network/, c2/, cicd/, mobile/, ics/, physical/, ai/, telemetry/, hunts/) - trust models + class indexes.

Browse by attack class

AD classes c14-c19 live under ad/classes/ (Kerberos, DCSync, AD CS, delegation, ACL persistence, coercion). Full table with status splits: INDEX.md.

How to use

1. Pick a continent from CONTINENTS.md or a technique from TECHNIQUE-INDEX.md, or an attack class from INDEX.md.
2. Open classes/cN-*.md (or ad/classes/) for the fused page: named harden, data-source prerequisite, enable-first Sigma IDs, hunt, isolate, evict, restore, and a named lab test. classes/_TEMPLATE.md is the contract every class must pass.
3. Jump into patterns/ for the observable / data-source skeleton or sigma/ for the full ruleset.
4. For the system-level view, read the continent TRUST-MODEL.md and (on Windows) boundaries/.
5. For driver/BYOVD depth, use drivers/: the dated driver catalog, named BYOVD CVEs, HVCI + vulnerable-driver blocklist, and the detection map.
6. For SIEM/detection-logic depth, use splunk/: SPL fundamentals, alerting, Enterprise Security, and investigation patterns (a common deploy target for the Sigma rules in sigma/).

Scope

Defense engineering reference for systems the reader owns or is authorized to test. Dual-use: pair offense (sibling offensive libraries) with detection (this one). No payloads are hosted here beyond the Sigma detection rules and reference methodology.

Charter: a defense encyclopedia - the inverse of HackTricks. Every claimed continent has a trust model and fused classes that pass classes/_TEMPLATE.md. Mobile/ICS/AI are in-scope with honest "no Sigma corpus" notes. Blockchain, stego, and exploit-dev tutorials stay out of scope. See LIBRARY-GAPS.md for the original gap map.

Provenance and maintenance

PROVENANCE.md records every source and how the Sigma corpus was generated. sigma/gen_bridge.py regenerates the technique-indexed tree from a fresh SigmaHQ clone. gen_bridge.py at the root regenerates the per-class counts.