Malware sample library.

Splunk app to compare Endpoint Detection and Response solutions based on MITRE ATT&CK evaluations (APT3, APT29, Carbanak + FIN7, Wizard Spider + Sandworm)

Tracking the Solarwinds Hack.

Dive into detailed technical analysis of critical vulnerabilities and malware. Stay informed, contribute, and help us improve cybersecurity together.

apt-emulation-platform

This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual attack data, converted to Splunk SPL, and validated for false positives.

APT infrastructure intelligence and IOC tracking platform

decompilation and static-analysis on the prevalent hermeticwiper

APT29 POSHSPY backdoor code

Structured incident investigations and threat hunting playbooks mimicking real-world APT tradecraft like APT29 and FIN7.

Audit Google Workspace for App-Specific Passwords that bypass MFA (the UNC6293/APT29 Gmail attack vector). Admin SDK enumeration, reporting, and bulk revocation.

Red team exercises and threat emulation projects — APT29 full kill-chain simulation and APT28 spearphishing emulation, mapped to MITRE ATT&CK.

Evidence-driven Windows incident investigation using the OTRF APT29 dataset: Sysmon, PowerShell, persistence, credential access, WinRM/PsExec lateral movement, threat hunting and Sigma detections.