Blue Team Toolkit

Splunk - Failed Authentication Hunt

SIEM & Logging Cross-Platform Command Line

Search for failed authentication attempts across all systems to identify brute force attacks or credential stuffing attempts.

Detect potential brute force attacks by finding source IPs with multiple failed login attempts.

authenticationbrute-forcesplunkhunting

ELK - Lateral Movement Detection

SIEM & Logging Cross-Platform Command Line

Detect lateral movement by analyzing authentication events across multiple systems from a single source.

Identify compromised accounts being used to move laterally across the network.

lateral-movementelkauthenticationdetection

Windows Event Log - Successful Logon Analysis

SIEM & Logging Windows Command Line

Query Windows Event Logs for successful authentication events to track user activity and detect anomalies.

Investigate successful logons during suspicious time periods or from unexpected locations.

windowsevent-logauthenticationpowershell

Syslog Parsing - Failed SSH Attempts

SIEM & Logging Linux Command Line

Parse syslog files to identify failed SSH authentication attempts, indicating potential brute force attacks.

Detect SSH brute force attacks by analyzing authentication failures in syslog.

sshlinuxsyslogbrute-force

Volatility - List Running Processes

Forensics WindowsLinux Command Line

Extract list of running processes from memory dump to identify malicious processes or anomalies.

During incident response, analyze memory dump to find suspicious processes that may have been hidden or terminated.

memory-analysisforensicsvolatilityprocesses

Volatility - Network Connections

Forensics WindowsLinux Command Line

Extract network connections from memory dump to identify suspicious network activity and C2 communications.

Identify network connections established by malware or compromised processes in memory.

memory-analysisnetworkvolatilityc2

Live Response - Timeline Creation

Incident Response Windows Script/Automation

Create a timeline of system activity using multiple Windows artifacts to understand attack timeline.

Build comprehensive timeline of events during incident response to understand attack progression.

timelineforensicsplasoincident-response

Windows Artifact Collection Script

Incident Response Windows Script/Automation

Automated collection of critical Windows artifacts for incident response including registry, event logs, and file system artifacts.

Rapidly collect forensic artifacts from compromised systems during incident response.

powershellartifact-collectionincident-responsewindows

Wireshark - HTTP Traffic Filter

Network Analysis Cross-Platform GUI Application

Filter network capture to show only HTTP traffic for analysis of web-based attacks or data exfiltration.

Investigate potential data exfiltration by analyzing HTTP POST requests and responses.

wiresharknetworkhttppcap

tcpdump - DNS Query Capture

Network Analysis LinuxmacOS Command Line

Capture DNS queries to identify suspicious domain lookups and potential C2 communications.

Monitor DNS traffic to detect malware beaconing or data exfiltration via DNS tunneling.

tcpdumpdnsnetworkcapture

Zeek - HTTP Analysis

Network Analysis Linux Command Line

Analyze HTTP traffic using Zeek logs to identify suspicious user agents, unusual HTTP methods, or data exfiltration.

Parse network traffic to extract HTTP metadata and identify malicious web activity.

zeekbrohttpnetwork

NetFlow Analysis - Suspicious Connections

Network Analysis Cross-Platform Command Line

Analyze NetFlow data to identify unusual network patterns, large data transfers, or connections to suspicious IPs.

Detect data exfiltration or C2 communications by analyzing network flow data.

netflownetworktraffic-analysis

PowerShell - Process Investigation

Endpoint Detection Windows Command Line

Investigate running processes, their command lines, and parent processes to identify suspicious activity.

Identify suspicious processes, hidden processes, or processes with unusual command-line arguments.

powershellprocesseswindowsinvestigation

Autoruns - Startup Analysis

Endpoint Detection Windows GUI Application

Analyze all autorun locations in Windows to identify persistence mechanisms used by malware.

Identify malware persistence mechanisms by examining all startup locations and scheduled tasks.

autorunspersistencewindowsmalware

Registry Forensics - Persistence Keys

Endpoint Detection Windows Command Line

Query Windows Registry for common persistence locations to identify malware autorun mechanisms.

Identify malware persistence by examining registry autorun keys.

registrypersistencewindowsforensics

Sysmon - Process Creation Monitoring

Endpoint Detection Windows Command Line

Monitor process creation events using Sysmon to detect suspicious process execution patterns.

Detect suspicious process execution, including processes launched from unusual locations or with suspicious command-line arguments.

sysmonprocess-monitoringwindowsdetection

Sigma - Suspicious Execution Detection

Threat Hunting Cross-Platform Script/Automation

Use Sigma rules to detect suspicious process execution patterns across SIEM platforms.

Detect suspicious execution patterns like living-off-the-land techniques or process injection.

sigmathreat-huntingdetection-rules

YARA - Malware Scanning

Threat Hunting Cross-Platform Command Line

Scan files and memory using YARA rules to identify known malware families or suspicious patterns.

Identify malware samples or suspicious files using signature-based detection.

yaramalwarescanningsignatures

IOC Search - File Hash Lookup

Threat Hunting Cross-Platform Command Line

Search for Indicators of Compromise (IOCs) like file hashes across systems to identify known threats.

Identify known malicious files by searching for their hashes across the environment.

iochashthreat-intelhunting

Behavioral Query - PowerShell Obfuscation

Threat Hunting Windows Command Line

Detect obfuscated PowerShell execution by searching for common obfuscation patterns and encoded commands.

Identify malicious PowerShell execution that uses obfuscation techniques to evade detection.

powershellobfuscationbehavioralhunting

VirusTotal API - Hash Lookup

Threat Intelligence Cross-Platform API/Integration

Query VirusTotal API to check file hashes, URLs, or IPs against threat intelligence database.

Check suspicious files, URLs, or IPs against VirusTotal's threat intelligence database.

virustotalapithreat-intelhash

Shodan - IP Intelligence

Threat Intelligence Cross-Platform API/Integration

Query Shodan to gather intelligence about IP addresses, domains, and exposed services.

Investigate external IPs involved in security incidents to gather threat intelligence.

shodanthreat-intelip-intelosint

MISP - IOC Import

Threat Intelligence Cross-Platform API/Integration

Import Indicators of Compromise into MISP threat intelligence platform for sharing and correlation.

Share threat intelligence indicators with security teams and correlate with existing events.

mispthreat-inteliocsharing

PE-bear - PE File Analysis

Malware Analysis Windows GUI Application

Analyze Portable Executable (PE) files to examine imports, exports, sections, and metadata for malware analysis.

Analyze malware samples to understand their structure, imports, and potential functionality.

pe-analysismalwarewindowsreverse-engineering

Strings - Extract ASCII/Unicode Strings

Malware Analysis Cross-Platform Command Line

Extract printable strings from binary files to identify URLs, file paths, API calls, and other indicators.

Extract readable strings from malware samples to identify C2 domains, API calls, or other indicators.

stringsmalware-analysisforensics

Cuckoo Sandbox - Automated Malware Analysis

Malware Analysis Linux Web-based

Automated malware analysis platform that executes samples in isolated environments and generates detailed reports.

Automatically analyze malware samples in a safe environment to understand their behavior and generate IOCs.

sandboxmalware-analysisautomation

AWS CloudTrail - Suspicious API Calls

Cloud Security Cloud (AWS/Azure/GCP) Command Line

Query AWS CloudTrail logs to identify suspicious API calls, unauthorized access, or unusual activity.

Detect unauthorized access or suspicious activity in AWS environment by analyzing CloudTrail logs.

awscloudtrailcloud-securityapi

Azure AD - Audit Log Analysis

Cloud Security Cloud (AWS/Azure/GCP) API/Integration

Query Azure AD audit logs to detect suspicious sign-ins, privilege escalations, or unauthorized access.

Investigate suspicious authentication events and privilege escalations in Azure AD.

azureactive-directorycloud-securityaudit

GCP - Audit Log Analysis

Cloud Security Cloud (AWS/Azure/GCP) Command Line

Query Google Cloud Platform audit logs to identify suspicious activity, unauthorized access, or policy violations.

Detect security incidents and policy violations in GCP by analyzing audit logs.

gcpgoogle-cloudaudit-logscloud-security

Active Directory - User Enumeration

Active Directory Windows Command Line

Enumerate Active Directory users to identify accounts with excessive privileges or suspicious configurations.

Identify accounts with weak security configurations, disabled accounts, or accounts that haven't logged in recently.

active-directoryuser-enumerationwindowspowershell

BloodHound - AD Attack Path Analysis

Active Directory WindowsLinux GUI Application

Visualize Active Directory attack paths and identify privilege escalation opportunities.

Identify attack paths in Active Directory that could lead to domain compromise.

bloodhoundactive-directoryattack-pathsprivilege-escalation

Active Directory - Group Membership Analysis

Active Directory Windows Command Line

Analyze Active Directory group memberships to identify users with excessive privileges or identify privilege escalation paths.

Identify users with administrative privileges and understand group membership hierarchies.

active-directorygroupsprivilegespowershell

Kerberoasting Detection - Service Account Analysis

Active Directory Windows Command Line

Detect potential Kerberoasting attacks by identifying service accounts with weak encryption or monitoring for suspicious ticket requests.

Detect Kerberoasting attacks by monitoring for service ticket requests using weak encryption types.

kerberoastingactive-directorydetectionwindows

Sysmon - File Creation Events (Event ID 11)

Forensics Windows Command Line

Query Sysmon Event ID 11 to identify all files created by processes, useful for tracking malware payloads and dropped files.

During DFIR investigations, identify all files created by malicious processes to understand the attack lifecycle and locate additional payloads.

sysmonfile-creationforensicsdfirevent-id-11

Sysmon - Timestomping Detection (Event ID 2)

Forensics Windows Command Line

Detect timestomping attacks using Sysmon Event ID 2, which logs when file creation times are modified to evade detection.

Identify when attackers modify file timestamps to hide evidence or make malicious files appear legitimate.

sysmontimestompingforensicsanti-forensicsevent-id-2

Sysmon - DNS Query Analysis (Event ID 22)

Network Analysis Windows Command Line

Analyze DNS queries logged by Sysmon Event ID 22 to identify suspicious domain lookups and potential C2 communications.

Detect malware beaconing, data exfiltration via DNS, or C2 communications by analyzing DNS query patterns.

sysmondnsnetwork-analysisc2-detectionevent-id-22

Sysmon - Network Connection Tracking (Event ID 3)

Network Analysis Windows Command Line

Track network connections using Sysmon Event ID 3 to identify C2 communications, data exfiltration, and lateral movement.

Identify exact destination IP addresses and ports used for C2 communication or data exfiltration during incident response.

sysmonnetworkc2-detectionlateral-movementevent-id-3

Sysmon - Process Termination Tracking (Event ID 5)

Forensics Windows Command Line

Track process termination events using Sysmon Event ID 5 to understand the complete lifecycle of malicious processes.

Track when malicious processes exit to understand execution timelines and identify self-terminating malware.

sysmonprocess-terminationforensicsevent-id-5

PowerShell - Alternate Data Stream Detection

Endpoint Detection Windows Command Line

Detect Alternate Data Streams (ADS) in NTFS file systems using PowerShell to identify hidden malicious payloads.

Identify hidden data streams that attackers use to hide malicious payloads within legitimate files, evading traditional file scanning.

powershelladsntfsfile-forensicsdata-hiding

SMBv1 Compliance Check - ISM-1962

Endpoint Detection Windows Command Line

Verify SMBv1 is disabled to comply with ISM-1962 and prevent EternalBlue-style attacks. Check server configuration, Windows feature state, and client settings.

Ensure SMBv1 is completely disabled across the environment to prevent exploitation of legacy protocol vulnerabilities like EternalBlue.

smbism-1962compliancewindowseternalblue

Cipher.exe Anti-Forensics Detection

Forensics Windows Command Line

Detect cipher.exe /w usage which overwrites deleted file data to prevent forensic recovery, indicating anti-forensics activity.

Identify when attackers use cipher.exe /w to destroy forensic evidence by overwriting deleted file data on disk.

cipheranti-forensicssysmonfile-deletiont1070.004

CrowdStrike CQL - Process Execution Detection

Endpoint Detection WindowsLinuxmacOS Web-based

Query CrowdStrike Falcon for process execution events to detect suspicious process launches, command-line arguments, and parent-child relationships.

Detect suspicious process execution patterns, including processes launched from unusual locations, with suspicious command-line arguments, or from unexpected parent processes.

crowdstrikecqlprocess-executionedrdetection

CrowdStrike CQL - File Creation Events

Forensics WindowsLinuxmacOS Web-based

Query CrowdStrike Falcon for file creation events to identify dropped files, malware payloads, and suspicious file activity.

Identify files created in suspicious locations like AppData, Temp folders, or system directories that may indicate malware activity.

crowdstrikecqlfile-creationforensicsedr

CrowdStrike CQL - Network Connection Analysis

Network Analysis WindowsLinuxmacOS Web-based

Query CrowdStrike Falcon for network connection events to identify C2 communications, data exfiltration, and suspicious network activity.

Detect C2 communications, data exfiltration, or lateral movement by analyzing network connections to external IPs or unusual ports.

crowdstrikecqlnetworkc2-detectionedr

CrowdStrike CQL - Registry Modification Detection

Endpoint Detection Windows Web-based

Query CrowdStrike Falcon for registry modification events to detect persistence mechanisms, configuration changes, and suspicious registry activity.

Detect malware persistence mechanisms by monitoring registry autorun keys, service registrations, and other persistence locations.

crowdstrikecqlregistrypersistencewindows

CrowdStrike CQL - DNS Query Analysis

Network Analysis WindowsLinuxmacOS Web-based

Query CrowdStrike Falcon for DNS query events to identify suspicious domain lookups, C2 communications, and DNS tunneling attempts.

Detect malware beaconing, C2 communications, or data exfiltration via DNS by analyzing DNS query patterns and suspicious domains.

crowdstrikecqldnsc2-detectionnetwork

CrowdStrike CQL - File Deletion Detection

Forensics WindowsLinuxmacOS Web-based

Query CrowdStrike Falcon for file deletion events to detect anti-forensics activity, evidence destruction, or suspicious file cleanup.

Detect anti-forensics activity when attackers delete log files, event logs, or other forensic artifacts to cover their tracks.

crowdstrikecqlfile-deletionanti-forensicsedr

CrowdStrike CQL - PowerShell Execution Detection

Threat Hunting Windows Web-based

Query CrowdStrike Falcon for PowerShell execution events to detect obfuscated commands, encoded scripts, and suspicious PowerShell activity.

Detect malicious PowerShell execution that uses obfuscation techniques like Base64 encoding, download strings, or encoded commands.

crowdstrikecqlpowershellobfuscationthreat-hunting

CrowdStrike CQL - Lateral Movement Detection

Threat Hunting Windows Web-based

Query CrowdStrike Falcon to detect lateral movement by analyzing authentication events, network connections, and process execution across multiple systems.

Identify compromised accounts being used to move laterally across the network by detecting logons to multiple systems from a single user account.

crowdstrikecqllateral-movementauthenticationthreat-hunting

CrowdStrike CQL - Alternate Data Stream Detection

Endpoint Detection Windows Web-based

Query CrowdStrike Falcon for Alternate Data Stream (ADS) activity to detect hidden malicious payloads stored in NTFS file streams.

Detect when attackers hide malicious payloads in Alternate Data Streams to evade traditional file scanning and detection.

crowdstrikecqladsntfsfile-forensics