Detection Defense Library

One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo.

This repo folds in five former sibling repositories:

The problem this solves

Detection engineering knowledge is split across patterns, Sigma rules, trust-boundary models, and tooling with no single spine. This repo fuses them: for any attack class you get the model of how the attack works, the observable to watch, the committed Sigma rules that catch it, and the harden/isolate/evict path. It is the inverse of HackTricks: a defense encyclopedia instead of an offense dump.

Quick start (it is a reference; nothing to install)

git clone [email protected]:WattoCyber/detection-defense-library.git
cd detection-defense-library

# 1. start by attack class (the fused view)
less classes/c01-uac-bypass.md # e.g. UAC bypass

# 2. or browse by continent / platform
less CONTINENTS.md

# 3. or find a technique
less TECHNIQUE-INDEX.md

Each classes/cN-*.md page is end-to-end: model, harden, detect, hunt, isolate, deceive, evict, restore, plus the Sigma rule IDs to enable first. Start at INDEX.md to see the full class map, then classes/_TEMPLATE.md for the contract every page follows.

Layout

• classes/ - browse by attack class (the fused view). One file per class is the end-to-end defense page (model through restore). Inventory counts live in INDEX.md.
• patterns/ - methodology patterns (p01-p11, p14-p34).
• CONTROL-MAP.md - ATT&CK mitigations / D3FEND / CIS / NIST overlay.
• METHODOLOGY.md - the detection development workflow.
• boundaries/ - Windows trust-boundary docs (b01 services..b10 token integrity).
• TRUST-MODEL.md - the trust-boundary synthesis model.
• drivers/ - the driver attack-surface: 661 dated driver records, BYOVD CVE catalog, HVCI + vulnerable-driver blocklist, and the detection map.
• splunk/ - the Splunk reference: SPL fundamentals, detection and alerting, Enterprise Security, and investigation patterns.

Browse by attack class

AD classes c14-c19 live under ad/classes/ (Kerberos, DCSync, AD CS, delegation, ACL persistence, coercion). Full table with status splits: INDEX.md.

How to use

1. Pick a continent from CONTINENTS.md or a technique from TECHNIQUE-INDEX.md, or an attack class from INDEX.md.
2. Open classes/cN-*.md (or ad/classes/) for the fused page: named harden, data-source prerequisite, enable-first Sigma IDs, hunt, isolate, evict, restore, and a named lab test. classes/_TEMPLATE.md is the contract every class must pass.
3. Jump into patterns/ for the observable / data-source skeleton or sigma/ for the full ruleset.
4. For the system-level view, read the continent TRUST-MODEL.md and (on Windows) boundaries/.
5. For driver/BYOVD depth, use drivers/: the dated driver catalog, named BYOVD CVEs, HVCI + vulnerable-driver blocklist, and the detection map.
6. For SIEM/detection-logic depth, use splunk/: SPL fundamentals, alerting, Enterprise Security, and investigation patterns (a common deploy target for the Sigma rules in ).

Scope

Defense engineering reference for systems the reader owns or is authorized to test. Dual-use: pair offense (sibling offensive libraries) with detection (this one). No payloads are hosted here beyond the Sigma detection rules and reference methodology.

Charter: a defense encyclopedia - the inverse of HackTricks. Every claimed continent has a trust model and fused classes that pass classes/_TEMPLATE.md. Mobile/ICS/AI are in-scope with honest "no Sigma corpus" notes. Blockchain, stego, and exploit-dev tutorials stay out of scope. See LIBRARY-GAPS.md for the original gap map.

Provenance and maintenance

PROVENANCE.md records every source and how the Sigma corpus was generated. sigma/gen_bridge.py regenerates the technique-indexed tree from a fresh SigmaHQ clone. gen_bridge.py at the root regenerates the per-class counts.