leftanti

Resources

24 links in 6 categories, all of them somebody else's work

ThreatIntel4 What is actually being exploited, and who is doing it.

  4. The DFIR Report

    thedfirreport.com — Full intrusion walkthroughs with timelines and detections

KqlReferences4 Language docs and schema references worth keeping open in a tab.
DetectionEngineering4 Frameworks and rule sets for writing detections that survive review.

  1. MITRE ATT&CK

    attack.mitre.org — The shared vocabulary, and the coverage map

  2. Sigma

    github.com — Vendor-neutral detection rules, convertible to KQL

  3. Atomic Red Team

    github.com — Small tests per technique, for proving a detection actually fires

Dfir4 Forensics and incident response tooling.

  2. Velociraptor

    docs.velociraptor.app — Endpoint visibility and hunting at scale, with its own query language

  3. Volatility

    volatilityfoundation.org — Memory forensics

TrainingAndCerts4 Hands-on practice, weighted towards blue team.

  2. LetsDefend

    letsdefend.io — SOC analyst workflow practice in a simulated queue

  3. TryHackMe

    tryhackme.com — Broad, beginner-friendly, useful for filling gaps

  4. Microsoft SC-200

    learn.microsoft.com — The Sentinel and Defender certification path

Tools4 Things to paste an artefact into at two in the morning.

  1. CyberChef

    gchq.github.io — Decode, deobfuscate, and convert anything

  2. VirusTotal

    virustotal.com — Hash and file reputation. Mind what you upload

  3. urlscan.io

    urlscan.io — Detonate a URL and see what it serves

  4. jwt.io

    jwt.io — Decode a token when a sign-in log stops making sense