Detection Defense Library

One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo.

This repo folds in four former sibling repositories:

Layout

• classes/ — browse by attack class (the fused view). One file per class is the end-to-end defense page (model through restore). Inventory counts live in INDEX.md.
• patterns/ — methodology patterns (p01–p11, p14–p34).
• CONTROL-MAP.md — ATT&CK mitigations / D3FEND / CIS / NIST overlay.
• METHODOLOGY.md — the detection development workflow.
• boundaries/ — Windows trust-boundary docs (b01 services..b10 token integrity).
• TRUST-MODEL.md — the trust-boundary synthesis model.
• drivers/ — the driver attack-surface: 661 dated driver records, BYOVD CVE catalog, HVCI + vulnerable-driver blocklist, and the detection map.
• splunk/ — the Splunk reference: SPL fundamentals, detection and alerting, Enterprise Security, and investigation patterns.

Browse by attack class

AD classes c14–c19 live under ad/classes/ (Kerberos, DCSync, AD CS, delegation, ACL persistence, coercion). Full table with status splits: INDEX.md.

How to use

1. Pick a continent from CONTINENTS.md or a technique from TECHNIQUE-INDEX.md, or an attack class from INDEX.md.
2. Open classes/cN-*.md (or ad/classes/) for the fused page: named harden, data-source prerequisite, enable-first Sigma IDs, hunt, isolate, evict, restore, and a named lab test. classes/_TEMPLATE.md is the contract every class must pass.
3. Jump into patterns/ for the observable / data-source skeleton or sigma/ for the full ruleset.
4. For the system-level view, read the continent TRUST-MODEL.md and (on Windows) boundaries/.
5. For driver/BYOVD depth, use drivers/: the dated driver catalog, named BYOVD CVEs, HVCI + vulnerable-driver blocklist, and the detection map.
6. For SIEM/detection-logic depth, use splunk/: SPL fundamentals, alerting, Enterprise Security, and investigation patterns (a common deploy target for the Sigma rules in ).

Scope

Defense engineering reference for systems the reader owns or is authorized to test. Dual-use: pair offense (sibling offensive libraries) with detection (this one). No payloads are hosted here beyond the Sigma detection rules and reference methodology.

Charter: a defense encyclopedia — the inverse of HackTricks. Every claimed continent has a trust model and fused classes that pass classes/_TEMPLATE.md. Mobile/ICS/AI are in-scope with honest "no Sigma corpus" notes. Blockchain, stego, and exploit-dev tutorials stay out of scope. See LIBRARY-GAPS.md for the original gap map.

Provenance and maintenance

PROVENANCE.md records every source and how the Sigma corpus was generated. sigma/gen_bridge.py regenerates the technique-indexed tree from a fresh SigmaHQ clone. gen_bridge.py at the root regenerates the per-class counts.