One defense-engineering library, consolidated. Attack classes, the patterns
that detect them, the committed Sigma rules, and the Windows trust-boundary
model, all in a single repo.
This repo folds in five former sibling repositories:
Former repo
Folded into
What it holds
detection-engineering-patterns
patterns/ + METHODOLOGY.md
Worked patterns: attack class to observable, data source, and Sigma rule
all-the-sigma-you-need
sigma/
3,141 Sigma rules indexed by MITRE ATT&CK technique + tactic
Detection engineering knowledge is split across patterns, Sigma rules,
trust-boundary models, and tooling with no single spine. This repo fuses them:
for any attack class you get the model of how the attack works, the observable
to watch, the committed Sigma rules that catch it, and the harden/isolate/evict
path. It is the inverse of HackTricks: a defense encyclopedia instead of an
offense dump.
Quick start (it is a reference; nothing to install)
root@kitploit:~
git clone [email protected]:WattoCyber/detection-defense-library.git
cd detection-defense-library
# 1. start by attack class (the fused view)
less classes/c01-uac-bypass.md # e.g. UAC bypass
# 2. or browse by continent / platform
less CONTINENTS.md
# 3. or find a technique
less TECHNIQUE-INDEX.md
Each classes/cN-*.md page is end-to-end: model, harden, detect, hunt,
isolate, deceive, evict, restore, plus the Sigma rule IDs to enable first.
Start at INDEX.md to see the full class map, then classes/_TEMPLATE.md
for the contract every page follows.
Layout
classes/ - browse by attack class (the fused view). One file per class
is the end-to-end defense page (model through restore). Inventory
counts live in INDEX.md.
AD classes c14-c19 live under ad/classes/ (Kerberos, DCSync, AD CS,
delegation, ACL persistence, coercion). Full table with status splits:
INDEX.md.
How to use
Pick a continent from CONTINENTS.md or a technique from
TECHNIQUE-INDEX.md, or an attack class from INDEX.md.
Open classes/cN-*.md (or ad/classes/) for the fused page: named
harden, data-source prerequisite, enable-first Sigma IDs, hunt,
isolate, evict, restore, and a named lab test. classes/_TEMPLATE.md
is the contract every class must pass.
Jump into patterns/ for the observable / data-source skeleton or
sigma/ for the full ruleset.
For the system-level view, read the continent TRUST-MODEL.md and
(on Windows) boundaries/.
For driver/BYOVD depth, use drivers/: the dated driver catalog, named
BYOVD CVEs, HVCI + vulnerable-driver blocklist, and the detection map.
For SIEM/detection-logic depth, use splunk/: SPL fundamentals, alerting,
Enterprise Security, and investigation patterns (a common deploy target
for the Sigma rules in sigma/).
Scope
Defense engineering reference for systems the reader owns or is authorized to
test. Dual-use: pair offense (sibling offensive libraries) with detection
(this one). No payloads are hosted here beyond the Sigma detection rules and
reference methodology.
Charter: a defense encyclopedia - the inverse of HackTricks. Every claimed
continent has a trust model and fused classes that pass
classes/_TEMPLATE.md. Mobile/ICS/AI are in-scope with honest "no Sigma
corpus" notes. Blockchain, stego, and exploit-dev tutorials stay out of
scope. See LIBRARY-GAPS.md for the original gap map.
Provenance and maintenance
PROVENANCE.md records every source and how the Sigma corpus was generated.
sigma/gen_bridge.py regenerates the technique-indexed tree from a fresh
SigmaHQ clone. gen_bridge.py at the root regenerates the per-class counts.
wattocyber/detection-defense-library
