detection-defense-library

# Detection Defense Library

![Detection Defense Library banner](https://gitlab.com/wattocyber/detection-defense-library/-/raw/main/banner.png)

[![license](https://img.shields.io/badge/license-MIT-2d6a4f)](LICENSE) [![gitlab](https://img.shields.io/badge/gitlab-WattoCyber-fc6d26)](https://gitlab.com/WattoCyber/detection-defense-library)

One defense-engineering library, consolidated. Attack classes, the patterns
that detect them, the committed Sigma rules, and the Windows trust-boundary
model, all in a single repo.

This repo folds in five former sibling repositories:

| Former repo | Folded into | What it holds |
|---|---|---|
| `detection-engineering-patterns` | `patterns/` + `METHODOLOGY.md` | Worked patterns: attack class to observable, data source, and Sigma rule |
| `all-the-sigma-you-need` | `sigma/` | 3,141 Sigma rules indexed by MITRE ATT&CK technique + tactic |
| `windows-trust-boundary-blueprint` | `boundaries/` + `TRUST-MODEL.md` | Component-indexed Windows trust-boundary model |
| `windows-driver-surface` | `drivers/` | Dated driver attack-surface: 661 BYOVD/vulnerable driver records, HVCI + blocklist, detection map |
| `splunk-cheatsheet` | `splunk/` | Practical Splunk reference: SPL, detection/alerting, ES, investigation patterns |

## The problem this solves

Detection engineering knowledge is split across patterns, Sigma rules,
trust-boundary models, and tooling with no single spine. This repo fuses them:
for any attack class you get the model of how the attack works, the observable
to watch, the committed Sigma rules that catch it, and the harden/isolate/evict
path. It is the inverse of HackTricks: a defense encyclopedia instead of an
offense dump.

## Quick start (it is a reference; nothing to install)

```bash
git clone [email protected]:WattoCyber/detection-defense-library.git
cd detection-defense-library

# 1. start by attack class (the fused view)
less classes/c01-uac-bypass.md # e.g. UAC bypass

# 2. or browse by continent / platform
less CONTINENTS.md

# 3. or find a technique
less TECHNIQUE-INDEX.md
```

Each `classes/cN-*.md` page is end-to-end: model, harden, detect, hunt,
isolate, deceive, evict, restore, plus the Sigma rule IDs to enable first.
Start at `INDEX.md` to see the full class map, then `classes/_TEMPLATE.md`
for the contract every page follows.

## Layout

- `classes/` - browse by attack class (the fused view). One file per class
 is the end-to-end defense page (model through restore). Inventory
 counts live in `INDEX.md`.
- `patterns/` - methodology patterns (`p01`-`p11`, `p14`-`p34`).
- `CONTROL-MAP.md` - ATT&CK mitigations / D3FEND / CIS / NIST overlay.
- `METHODOLOGY.md` - the detection development workflow.
- `boundaries/` - Windows trust-boundary docs (b01 services..b10 token
 integrity).
- `TRUST-MODEL.md` - the trust-boundary synthesis model.
- `drivers/` - the driver attack-surface: 661 dated driver records, BYOVD CVE
 catalog, HVCI + vulnerable-driver blocklist, and the detection map.
- `splunk/` - the Splunk reference: SPL fundamentals, detection and alerting,
 Enterprise Security, and investigation patterns.
- `sigma/` - the full Sigma corpus, indexed by MITRE ATT&CK technique and
 tactic (`INDEX.md`, `TACTICS.md`, `DETECTION-GAPS.md`).
- `LIBRARY-GAPS.md` - library-shape gaps vs a full defense encyclopedia
 (the antithesis of HackTricks). Rule-count gaps stay in
 `sigma/DETECTION-GAPS.md`.
- `CONTINENTS.md` - platform → primitive → page (the HackTricks spine).
- `TECHNIQUE-INDEX.md` - ATT&CK technique → fused class.
- `classes/_TEMPLATE.md` - done-definition for a fused class page
 (model, harden, detect, hunt, isolate, deceive, evict, restore).
- Continents (`ad/`, `linux/`, `macos/`, `identity/`, `cloud/`, `email/`,
 `web/`, `network/`, `c2/`, `cicd/`, `mobile/`, `ics/`, `physical/`,
 `ai/`, `telemetry/`, `hunts/`) - trust models + class indexes.

## Browse by attack class

| Class | Attack | Pattern | Sigma technique dirs | Rules |
|---|---|---|---|---|
| c01 | UAC bypass | `patterns/p01-uac-bypass.md` | `sigma/rules/t1548.002` | 56 |
| c02 | BYOVD driver load | `patterns/p02-byovd-driver-load.md` | `sigma/rules/t1068`, `t1547.008` | 16 |
| c03 | LSASS / token theft | `patterns/p03-token-theft-lsass.md` | `sigma/rules/t1003*` | 185 |
| c04 | Service abuse | `patterns/p04-service-abuse.md` | `sigma/rules/t1543.003` | 38 |
| c05 | Registry persistence | `patterns/p05-registry-persistence.md` | `sigma/rules/t1547.001` | 31 |
| c06 | Signed-binary proxy (LOLBins) | `patterns/p06-lolbins.md` | `sigma/rules/t1218*` | 179 |
| c07 | PowerShell | `patterns/p07-powershell.md` | `sigma/rules/t1059.001` | 180 |
| c08 | Defense impairment | `patterns/p08-defense-impairment.md` | `sigma/rules/t1685*`, `t1686.003` | 200 |
| c09 | DLL search-order hijack | `patterns/p09-dll-hijack.md` | `sigma/rules/t1574.001` | 80 |
| c10 | WMI execution / persistence | `patterns/p10-wmi-persistence.md` | `sigma/rules/t1047`, `t1546.003` | 58 |
| c11 | Scheduled tasks | `patterns/p11-scheduled-tasks.md` | `sigma/rules/t1053.005` | 31 |
| c12 | Token impersonation | `patterns/p03-token-theft-lsass.md` | `sigma/rules/t1134*` | 23 |
| c13 | Print spooler | `patterns/p02-byovd-driver-load.md` | `t1068` / `t1547.010` / `t1134.001` | scattered |
| c20 | Lateral movement | `patterns/p20-lateral-movement.md` | `t1021.002` `.001` `.006` `.003`, `t1047` | 36+15+10+13+47 |
| c21 | Phishing / user execution | `patterns/p21-phishing.md` | `t1566.001`, `t1566`, `t1566.002`, `t1204.002` | 19+11+3+28 |
| c22 | Valid accounts | `patterns/p22-valid-accounts.md` | `t1078`, `t1078.004` | 51+37 |
| c23 | Linux privilege escalation | `patterns/p23-linux-privesc.md` | `t1548.001`, `t1548.003`, `t1053.003`, `t1543.002` | 1+1+6+2 |
| c24 | Container escape | `patterns/p24-container-escape.md` | `t1611`, `t1609`, `t1552.007` | 2+3+4 |
| c25 | Cloud control plane | `patterns/p25-cloud-control-plane.md` | `t1078.004`, `t1098` | 37+31 |
| c26 | Kubernetes | `patterns/p26-kubernetes.md` | `t1611`, `t1609`, `t1552.007` | 20 k8s files |
| c27 | Web / webshell | `patterns/p27-web-webshell.md` | `t1190`, `t1505.003` | 46+23 |
| c28 | C2 / tunnel / exfil | `patterns/p28-c2-tunnel-exfil.md` | `t1572`, `t1090`, `t1105` | 23+21+70 |
| c29 | CI/CD / supply chain | `patterns/p29-cicd-supply-chain.md` | `t1195*` | thin |
| c30 | macOS trust | (fused in class) | `t1553.001`, `t1547.015`, `t1569.001`, `t1543.001/.004` | 1+1+1+2+2 |
| c31 | Mobile / MDM | `patterns/p31-mobile-mdm.md` | Mobile matrix | no Sigma |
| c32 | ICS / OT | `patterns/p32-ics-ot.md` | ICS matrix | no Sigma |
| c33 | Physical / firmware / wireless | `patterns/p33-physical-firmware-wireless.md` | `t1200`, `t1542.001`, `t1495` | 3+2+1 |
| c34 | AI agents / MCP | `patterns/p34-ai-agent-mcp.md` | emerging | no Sigma |

AD classes `c14`-`c19` live under `ad/classes/` (Kerberos, DCSync, AD CS,
delegation, ACL persistence, coercion). Full table with status splits:
`INDEX.md`.

## How to use

1. Pick a continent from `CONTINENTS.md` or a technique from
 `TECHNIQUE-INDEX.md`, or an attack class from `INDEX.md`.
2. Open `classes/cN-*.md` (or `ad/classes/`) for the fused page: named
 harden, data-source prerequisite, enable-first Sigma IDs, hunt,
 isolate, evict, restore, and a named lab test. `classes/_TEMPLATE.md`
 is the contract every class must pass.
3. Jump into `patterns/` for the observable / data-source skeleton or
 `sigma/` for the full ruleset.
4. For the system-level view, read the continent `TRUST-MODEL.md` and
 (on Windows) `boundaries/`.
5. For driver/BYOVD depth, use `drivers/`: the dated driver catalog, named
 BYOVD CVEs, HVCI + vulnerable-driver blocklist, and the detection map.
6. For SIEM/detection-logic depth, use `splunk/`: SPL fundamentals, alerting,
 Enterprise Security, and investigation patterns (a common deploy target
 for the Sigma rules in `sigma/`).

## Scope

Defense engineering reference for systems the reader owns or is authorized to
test. Dual-use: pair offense (sibling offensive libraries) with detection
(this one). No payloads are hosted here beyond the Sigma detection rules and
reference methodology.

Charter: a defense encyclopedia - the inverse of HackTricks. Every claimed
continent has a trust model and fused classes that pass
`classes/_TEMPLATE.md`. Mobile/ICS/AI are in-scope with honest "no Sigma
corpus" notes. Blockchain, stego, and exploit-dev tutorials stay out of
scope. See `LIBRARY-GAPS.md` for the original gap map.

## Provenance and maintenance

`PROVENANCE.md` records every source and how the Sigma corpus was generated.
`sigma/gen_bridge.py` regenerates the technique-indexed tree from a fresh
SigmaHQ clone. `gen_bridge.py` at the root regenerates the per-class counts.