Detection Defense Library

One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo.

This repo folds in five former sibling repositories:

Former repo	Folded into	What it holds
detection-engineering-patterns	patterns/ + METHODOLOGY.md	Worked patterns: attack class to observable, data source, and Sigma rule
all-the-sigma-you-need	sigma/	3,141 Sigma rules indexed by MITRE ATT&CK technique + tactic
windows-trust-boundary-blueprint	boundaries/ + TRUST-MODEL.md	Component-indexed Windows trust-boundary model
windows-driver-surface	drivers/	Dated driver attack-surface: 661 BYOVD/vulnerable driver records, HVCI + blocklist, detection map
splunk-cheatsheet	splunk/	Practical Splunk reference: SPL, detection/alerting, ES, investigation patterns

The problem this solves

Detection engineering knowledge is split across patterns, Sigma rules, trust-boundary models, and tooling with no single spine. This repo fuses them: for any attack class you get the model of how the attack works, the observable to watch, the committed Sigma rules that catch it, and the harden/isolate/evict path. It is the inverse of HackTricks: a defense encyclopedia instead of an offense dump.

Quick start (it is a reference; nothing to install)

git clone [email protected]:WattoCyber/detection-defense-library.git
cd detection-defense-library

# 1. start by attack class (the fused view)
less classes/c01-uac-bypass.md # e.g. UAC bypass

# 2. or browse by continent / platform
less CONTINENTS.md

# 3. or find a technique
less TECHNIQUE-INDEX.md

Each classes/cN-*.md page is end-to-end: model, harden, detect, hunt, isolate, deceive, evict, restore, plus the Sigma rule IDs to enable first. Start at INDEX.md to see the full class map, then classes/_TEMPLATE.md for the contract every page follows.

Layout

• classes/ - browse by attack class (the fused view). One file per class is the end-to-end defense page (model through restore). Inventory counts live in INDEX.md.
• patterns/ - methodology patterns (p01-p11, p14-p34).
• CONTROL-MAP.md - ATT&CK mitigations / D3FEND / CIS / NIST overlay.
• METHODOLOGY.md - the detection development workflow.
• boundaries/ - Windows trust-boundary docs (b01 services..b10 token integrity).
• TRUST-MODEL.md - the trust-boundary synthesis model.
• drivers/ - the driver attack-surface: 661 dated driver records, BYOVD CVE catalog, HVCI + vulnerable-driver blocklist, and the detection map.
• splunk/ - the Splunk reference: SPL fundamentals, detection and alerting, Enterprise Security, and investigation patterns.
• sigma/ - the full Sigma corpus, indexed by MITRE ATT&CK technique and tactic (INDEX.md, TACTICS.md, DETECTION-GAPS.md).
• LIBRARY-GAPS.md - library-shape gaps vs a full defense encyclopedia (the antithesis of HackTricks). Rule-count gaps stay in sigma/DETECTION-GAPS.md.
• CONTINENTS.md - platform → primitive → page (the HackTricks spine).
• TECHNIQUE-INDEX.md - ATT&CK technique → fused class.
• classes/_TEMPLATE.md - done-definition for a fused class page (model, harden, detect, hunt, isolate, deceive, evict, restore).
• Continents (ad/, linux/, macos/, identity/, cloud/, email/, web/, network/, c2/, cicd/, mobile/, ics/, physical/, ai/, telemetry/, hunts/) - trust models + class indexes.

Browse by attack class

Class	Attack	Pattern	Sigma technique dirs	Rules
c01	UAC bypass	patterns/p01-uac-bypass.md	sigma/rules/t1548.002	56
c02	BYOVD driver load	patterns/p02-byovd-driver-load.md	sigma/rules/t1068, t1547.008	16
c03	LSASS / token theft	patterns/p03-token-theft-lsass.md	sigma/rules/t1003*	185
c04	Service abuse	patterns/p04-service-abuse.md	sigma/rules/t1543.003	38
c05	Registry persistence	patterns/p05-registry-persistence.md	sigma/rules/t1547.001	31
c06	Signed-binary proxy (LOLBins)	patterns/p06-lolbins.md	sigma/rules/t1218*	179
c07	PowerShell	patterns/p07-powershell.md	sigma/rules/t1059.001	180
c08	Defense impairment	patterns/p08-defense-impairment.md	sigma/rules/t1685*, t1686.003	200
c09	DLL search-order hijack	patterns/p09-dll-hijack.md	sigma/rules/t1574.001	80
c10	WMI execution / persistence	patterns/p10-wmi-persistence.md	sigma/rules/t1047, t1546.003	58
c11	Scheduled tasks	patterns/p11-scheduled-tasks.md	sigma/rules/t1053.005	31
c12	Token impersonation	patterns/p03-token-theft-lsass.md	sigma/rules/t1134*	23
c13	Print spooler	patterns/p02-byovd-driver-load.md	t1068 / t1547.010 / t1134.001	scattered
c20	Lateral movement	patterns/p20-lateral-movement.md	t1021.002 .001 .006 .003, t1047	36+15+10+13+47
c21	Phishing / user execution	patterns/p21-phishing.md	t1566.001, t1566, t1566.002, t1204.002	19+11+3+28
c22	Valid accounts	patterns/p22-valid-accounts.md	t1078, t1078.004	51+37
c23	Linux privilege escalation	patterns/p23-linux-privesc.md	t1548.001, t1548.003, t1053.003, t1543.002	1+1+6+2
c24	Container escape	patterns/p24-container-escape.md	t1611, t1609, t1552.007	2+3+4
c25	Cloud control plane	patterns/p25-cloud-control-plane.md	t1078.004, t1098	37+31
c26	Kubernetes	patterns/p26-kubernetes.md	t1611, t1609, t1552.007	20 k8s files
c27	Web / webshell	patterns/p27-web-webshell.md	t1190, t1505.003	46+23
c28	C2 / tunnel / exfil	patterns/p28-c2-tunnel-exfil.md	t1572, t1090, t1105	23+21+70
c29	CI/CD / supply chain	patterns/p29-cicd-supply-chain.md	t1195*	thin
c30	macOS trust	(fused in class)	t1553.001, t1547.015, t1569.001, t1543.001/.004	1+1+1+2+2
c31	Mobile / MDM	patterns/p31-mobile-mdm.md	Mobile matrix	no Sigma
c32	ICS / OT	patterns/p32-ics-ot.md	ICS matrix	no Sigma
c33	Physical / firmware / wireless	patterns/p33-physical-firmware-wireless.md	t1200, t1542.001, t1495	3+2+1
c34	AI agents / MCP	patterns/p34-ai-agent-mcp.md	emerging	no Sigma

AD classes c14-c19 live under ad/classes/ (Kerberos, DCSync, AD CS, delegation, ACL persistence, coercion). Full table with status splits: INDEX.md.

How to use

1. Pick a continent from CONTINENTS.md or a technique from TECHNIQUE-INDEX.md, or an attack class from INDEX.md.
2. Open classes/cN-*.md (or ad/classes/) for the fused page: named harden, data-source prerequisite, enable-first Sigma IDs, hunt, isolate, evict, restore, and a named lab test. classes/_TEMPLATE.md is the contract every class must pass.
3. Jump into patterns/ for the observable / data-source skeleton or sigma/ for the full ruleset.
4. For the system-level view, read the continent TRUST-MODEL.md and (on Windows) boundaries/.
5. For driver/BYOVD depth, use drivers/: the dated driver catalog, named BYOVD CVEs, HVCI + vulnerable-driver blocklist, and the detection map.
6. For SIEM/detection-logic depth, use splunk/: SPL fundamentals, alerting, Enterprise Security, and investigation patterns (a common deploy target for the Sigma rules in sigma/).

Scope