Results for “telemetry”
7 skills
mukul975 Detecting Living Off The Land With Lolbas
Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.
24.6k · bundle
mukul975 Hunting Saas Sso Token Abuse
Detect SSO and OAuth token replay and SaaS lateral movement using identity telemetry from Microsoft Entra ID and Okta.
24.6k · bundle
mukul975 Detecting Process Hollowing Technique
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.
24.6k · bundle
More results
mukul975 Detecting Evasion Techniques In Endpoint Logs
Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.
24.6k · bundle
github Resemble Detect
Detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using the Resemble AI platform.
36.2k · bundle
mukul975 Implementing Siem Correlation Rules For Apt
Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.
24.6k · bundle
mukul975 Detecting T1003 Credential Dumping With Edr
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
24.6k · bundle