yugoslavskiy

Develop Sigma rules for Atomic Red Team test (Windows)

6

- Subject: [Atomic Red Team project](https://github.com/redcanaryco/atomic-red-team/) - Author: @redcanaryco - Type: threat simulation tests - Requirements: Create one Pull Request per Sigma rule Please comment the issue with a task...

Develop Sigma rules for Privilege Escalation in Windows Environment

10

- Research (slides): [Hunting for Privilege Escalation in Windows Environment](https://www.slideshare.net/heirhabarov/hunting-for-privilege-escalation-in-windows-environment) - Author: Teymur Kheirkhabarov, [@HeirhabarovT](https://twitter.com/HeirhabarovT) - Type: Ready-made alerts (Kibana queries) - Requirements: Create one Pull Request per Sigma rule...

Develop Sigma rules for PowerShell Abuse

4

- Research (slides): [Hunting For PowerShell Abuse](https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse) - Author: Teymur Kheirkhabarov, [@HeirhabarovT](https://twitter.com/HeirhabarovT) - Type: Ready-made alerts (Kibana queries) - Requirements: Create one Pull Request per Sigma rule You can pick...

Develop Sigma rules for Lateral Movement in Windows Infrastructure

6

- Research (slides): [Hunting Lateral Movement in Windows Infrastructure](https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view?usp=sharing) - Author: Teymur Kheirkhabarov, [@HeirhabarovT](https://twitter.com/HeirhabarovT) - Type: Ready-made alerts (Splunk queries) - Requirements: Create one Pull Request per Sigma rule You...

Develop Sigma rules for Atomic Red Team test (Linux)

12

- Subject: [Atomic Red Team project](https://github.com/redcanaryco/atomic-red-team/) - Author: @redcanaryco - Type: threat simulation tests - Requirements: Create one Pull Request per Sigma rule - Pro tip: Consider developing Sigma rules...

Develop Sigma rules for Atomic Red Team test (macOS)

15

- Subject: [Atomic Red Team project](https://github.com/redcanaryco/atomic-red-team/) - Author: @redcanaryco - Type: threat simulation tests - Requirements: Create one Pull Request per Sigma rule - Pro tip: Consider developing Sigma rules...

Develop Responder for CB Response / Carbon Black Endpoint Detection and Response

10

**Feature description** Responder for CB Response (previous name) / Carbon Black Endpoint Detection and Response (current name) or just "Carbon Black EDR" that would be able to execute the following...

Develop Response Action RA3601: Lock user account

3

We are seeking for a help with Response Actions development. You are very welcome to contribute. Please use the existing placeholder for the [RA3601: Lock user account](https://github.com/atc-project/atc-react/tree/master/response_actions/RA_3601_lock_user_account.yml), as well as...

Connect RE&CT with Threat Detection/Hunting, Detection Rules, etc

5

## The context We need to be on the same page to discuss the problem and solution of Incident Response (IR) and Threat Detection (TD) connection. Here is some information...