Tahdidlarni aniqlash muhandisligi

Loyihalar

• Tahdidlarni aniqlash muhandisligi

  Custom SIEM + Sentinel BAS

  Python’da yozilgan SIEM va har bir aniqlash qoidasi haqiqatan ishlashini o‘lchaydigan hujum simulyatsiyasi dvigateli.

  • Sigma
  • MITRE ATT&CK
  • Python

  Loyiha tafsilotlari Usullar bo‘yicha tekshiruv natijalari GitHub’dagi manba kodi

• Purple Team laboratoriyasi

  Active Directory lab

  Hujumlarni taqlid qilish va SOC aniqlashini tekshirish uchun Active Directory laboratoriyasi. Hujum yo‘llari Windows va Sysmon telemetriyasi hamda MITRE ATT&CK usullari bilan bog‘langan.

  • Active Directory
  • Sysmon
  • MITRE ATT&CK

  GitHub’dagi manba kodi Maqolani o‘qish

• Xavfsizlik muhandisligi

  ARGUS

  ARGUS ishlaydigan Windows kompyuterini MITRE ATT&CK bilan belgilangan 16 ta tahdid detektori kuzatib boradi.

  • Python
  • Local AI
  • Windows

  ARGUS tahdidlarni qanday aniqlaydi Loyiha tafsilotlari

Maqolalar

• 2026-yil avgust5 daqiqalik o‘qish

  Full Kill Chain: From an LLMNR Broadcast to Domain Admin in My Own Active Directory Lab

  Nine attack phases, nine matching detections — red team and blue team, same person, same lab.

  • active directory
  • blue team
  • windows server
  • cybersecurity
  • red teaming

  Maqolani o‘qish

• 2026-yil avgust3 daqiqalik o‘qish

  Building a Detection Validation Engine — and Finding Out My Detection Rule Couldn’t Physically Fire

  Somewhere in building a SIEM and an Active Directory attack lab separately, I kept hitting the same annoying question: how do I actually know a detection rule works?

  • blue team
  • cybersecurity
  • threat detection
  • atomic red team
  • red team

  Maqolani o‘qish

• 2026-yil avgust4 daqiqalik o‘qish

  I Built My Own SIEM From Scratch. Here’s What Broke, and What I Learned Fixing It.

  Not another “top 10 SIEM tools” listicle — the actual debugging notes from building one.

  • software engineering
  • blue team
  • cybersecurity
  • siem
  • red team

  Maqolani o‘qish

Sigma qoidalari

SIEM’imdagi uchta qoida, har biri u aniqlaydigan ATT&CK usuli bilan bog‘langan. To‘liq to‘plam GitHub’da.

• Credential Dumping Tool ExecutionT1003 OS Credential DumpingKritik
• Encoded PowerShell Command ExecutionT1059.001 Command and Scripting Interpreter: PowerShellYuqori
• Suspicious Access to Administrative ShareT1570 Lateral Tool TransferO‘rta

Aniqlash mantiqini ko‘rish Barcha qoidalar GitHub’da

Usullar va vositalar

Sigma

SIEM’dagi aniqlash qoidalari yozilgan, muayyan platformaga bog‘lanmagan format.

MITRE ATT&CK

Har bir qoida va detektor u aniqlaydigan usul bilan belgilangan, shuning uchun qamrovni usullar bo‘yicha hisoblash mumkin.

Atomic Red Team

Sentinel BAS har bir aniqlash qoidasi ishlashini tekshirish uchun SIEM’ga qarshi ishga tushiradigan hujum usullari.

Sysmon

Active Directory laboratoriyasidan olingan Windows telemetriyasi: har bir hujum yo‘li jurnallarda qoldiradigan izi bilan bog‘langan.

Hujum zanjiri korrelyatsiyasi

SIEM 60 daqiqalik oyna ichidagi bog‘liq ogohlantirishlarni bitta zanjirga birlashtiradi.