🛡️ Blue Team Operations

A comprehensive defensive security knowledge base — detection, forensics, threat hunting, and incident response.

A curated encyclopedia of blue team tradecraft covering the full defensive lifecycle: Detect → Investigate → Respond → Hunt. Spanning Digital Forensics (DFIR), SIEM detection engineering, threat hunting, malware analysis, and incident response, with practical playbooks, SIEM queries, and tool references.

💡 Purple Team Note: This repo is the defensive counterpart to offensive techniques — many sections map directly to real-world attacks, making it ideal for detection engineering and purple team exercises.

---

🧭 How to Use This Repo

• Building detections? Head to Methodology/SIEM Search Queries (Splunk & Elastic) and Threat Hunting (Sigma, YARA, Sysmon).
• Running an investigation? Start with Methodology/Digital Forensics for OS-specific artifact guides.
• Responding to an incident? See Incident Response for lifecycle, frameworks, and playbooks.
• Learning the fundamentals? Begin with Cyber Security Frameworks and Theory.
• Analyzing AD attacks? Methodology/Active Directory/Attack Scenarios covers detection for common AD attacks.

---

📚 Table of Contents

Section	What's Inside
🧱 Frameworks	Kill chains, MITRE ATT&CK, Diamond Model, Pyramid of Pain
🕵️ Threat Intelligence	CTI methodology, IOC & file analysis
🔬 Digital Forensics	DFIR theory + per-platform artifact extraction
🚨 Incident Response	Lifecycle, frameworks, and playbooks
🦠 Malware Analysis	Analysis stages and Windows API behavior
🗺️ Methodology	The core detection & investigation playbooks
🎯 Threat Hunting	Sigma, YARA, Sysmon, detection indicators
📖 Theory	SIEM concepts, threat modelling, rootkits
🛠️ Tools	Forensics, SIEM, and detection tooling

---

🧱 Cyber Security Frameworks

Foundational models that underpin defensive operations:

• Cyber Kill Chain · Unified Kill Chain
• MITRE ATT&CK · Diamond Model · The Pyramid of Pain

---

🕵️ Cyber Threat Intelligence (CTI)

CTI fundamentals and analysis methodology:

• Definition & concepts
• Methodology: File Analysis · IP & Domain Analysis

---

🔬 Digital Forensics

In-depth DFIR reference material covering theory and platform-specific artifacts.

Area	Coverage
Theory	DFIR process, evidence collection, acquisition methods, anti-forensics, golden rules
Windows	Registry, evidence of execution, USB forensics, NTFS/MFT
Linux	Artifacts, auth logs, persistence, forensic imaging, rootkit hunting
Mobile	Android & iOS forensics, SIM cloning, cellular networks
Hypervisors	VMware & VirtualBox artifacts + memory dumps
Cross-platform	Browsers, email, cloud, database, ESE forensics
Artifact Extraction	IP addresses, port-scan detection

📌 See also the deeper, OS-by-OS breakdowns under Methodology/Digital Forensics.

---

🚨 Incident Response

The IR layer:

• Incident Response Lifecycle
• Frameworks · Playbooks

---

🦠 Malware Analysis

Malware analysis foundations:

• Analysis Stages · Windows API calls

---

🗺️ Methodology

The operational core of the repo — detailed, hands-on playbooks for detection and investigation.

🏰 Active Directory Defense

Monitoring, baselining, and attack detection:

• AD Visibility · Authentication Events · Logon Events · Kerberos
• Attack Scenarios — detecting Kerberoasting, DCSync, AS-REP Roasting, LSASS dumping, NTDS extraction, lateral movement, ransomware, and more

🔬 Digital Forensics (Deep Dive)

Comprehensive per-platform forensic methodology:

• Windows · Linux · MacOS · Mobile
• Memory — acquisition + Windows/Linux analysis
• File System — NTFS, FAT, EXT, MBR, GPT
• Browsers · Microsoft Office (OneDrive, Outlook, Teams)
• Tools — Volatility, KAPE, FTK Imager, Osquery

📊 Log Analysis

Making sense of the logs:

• Windows: Sysmon playbooks (malware persistence, phishing, USB attacks) · Event Viewer playbooks
• Linux: Auditd & log types
• Firewall · IDS · VPN · Web Servers

🔎 SIEM Search Queries

Ready-to-use detection queries:

• Splunk — C2, credential dumping, lateral movement, persistence, ransomware, DNS tunneling, and an experimental queries lab
• Elastic — command execution, account activity, web app detections

📡 Packet Capture Analysis

Network forensics:

• Wireshark — ARP/DNS spoofing, tunneling, exfiltration, Kerberos, SSL stripping
• Tshark — CLI usage & use cases

☁️ Cloud Defense

Cloud detection & investigation:

• AWS — CloudTrail, GuardDuty, IAM/EC2/S3/Lambda investigations
• Azure — Entra ID, Sentinel, Defender XDR, M365, KQL queries
• Containers — Falco runtime detection

🤖 AI Security & Other

• Artificial Intelligence — LLM hardening, RAG systems, supply chain
• Investigations — Linux triage + YARA threat hunting

---

🎯 Threat Hunting

Proactive detection tradecraft:

• Core Windows Processes · Detection Indicators · Windows Event IDs
• Sigma · YARA · Sysmon · Event Viewer

---

📖 Theory

Core defensive concepts:

• SIEM · SIEM Alerts · Threat Modelling · Rootkits

---

🛠️ Tools

Usage references for the defensive toolkit:

• Forensic Tools — Volatility Framework, Binwalk
• SIEM / Splunk — adding data, navigation, apps, queries
• Palo Alto Networks — Data Lake

---

🤝 Contributing

Contributions, corrections, and additions are welcome! Feel free to open an issue or submit a pull request.

📄 License

See LICENSE.md for details.

---

⭐ If you find this useful, consider starring the repo! ⭐

Built and maintained by H3llKa1ser

For educational and defensive security purposes.