Popular repositories Loading

1. Windows-Endpoint-Telemetry Windows-Endpoint-Telemetry Public

   Windows Telemetry Lab – Sysmon + Event ID 4688 + Splunk (Phase 1) Hands-on endpoint logging lab: Sysmon installation, Windows process telemetry, and SIEM ingestion.

2. Windows-Endpoint-Telemetry-and-SOC-Triage Windows-Endpoint-Telemetry-and-SOC-Triage Public

   Extended windows telemetry by validating host-based Sysmon and Event ID 4688 signals and preparing cloud-based SIEM ingestion for SOC-style detection and triage.

3. Endpoint-Telemetry-MITRE-Mapping Endpoint-Telemetry-MITRE-Mapping Public

   This lab demonstrates the process of analyzing Windows endpoint execution telemetry and mapping observed behavior to the MITRE ATT&CK framework, with a focus on analyst reasoning rather than tooling.

4. Process-Network-Correlation-Lab Process-Network-Correlation-Lab Public

   This activity consists of a PowerShell execution followed shortly by DNS resolution and outbound HTTP communication to the same domain.

5. hybrid-active-directory-lab hybrid-active-directory-lab Public

   This project documents the deployment of a hybrid Active Directory environment in Microsoft Azure and the operational tasks performed within it.