Defensive strategies, frameworks, and tools are essential for the Blue Team to detect, prevent, and respond to cyber threats.
Cybersecurity Frameworks
- NIST Cybersecurity Framework: A set of guidelines for private sector companies to follow to be better prepared in identifying, detecting, and responding to cyber attacks. (Resources Library, NIST CSF 2.0)
- CIS Controls: Prioritized set of actions to protect your organization and data from known cyber attack vectors. (Assessment Tool)
- NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations. (Machine Readable Data)
- PCI DSS: Payment Card Industry Data Security Standard for organizations that handle branded credit cards.
- SOC 2: Service Organization Control 2 - Trust Services Criteria for Service Organizations.
- COBIT: Control Objectives for Information and Related Technologies, a framework for IT management and governance. (Auditing COBIT 2019)
- ISO 27001/27002 Toolkit: A repository containing a comprehensive toolkit designed to help organizations implement the ISO 27001:2022 Information Security Management System (ISMS).
- ISF SOGP: The ISF Standard of Good Practice for Information Security (SOGP) is the leading authority on information security.
Cybersecurity HomeLab
- Kali Linux: Offensive toolkit for scanning, exploitation, and red teaming. Run in a VM to scan/exploit other lab systems.
- Metasploitable 2: Vulnerable Linux VM for safe exploit practice. Pair with Kali to test exploits & document.
- Vulnerable-AD: Insecure Active Directory lab. Use with Windows Server to simulate AD attacks.
- WebGoat: OWASP vulnerable web app. Run locally/Docker & complete built-in lessons.
- Juice Shop: Modern OWASP vuln app. Host locally & attempt SQLi, XSS, more.
- GoPhish: Phishing simulation platform. Send test phishing emails to lab inboxes.
- PortSwigger: Free web security labs. Work through online exploit challenges.
- Vulnserver: Windows buffer overflow server. Run in Win7 VM & exploit with Immunity Debugger.
- Vulnerable WP: Exploitable WordPress site. Install locally & test WP-specific exploits.
- CTFlearn: CTF challenges for all levels. Solve puzzles to improve across domains.
- pfSense: Firewall/router for segmentation. Place between VMs to control & inspect traffic.
- Suricata: IDS/IPS. Deploy inline with pfSense to detect/block threats.
- Wazuh: SIEM/XDR. Collect & analyze logs from lab machines.
- OpenSearch: Search/visualization stack. Integrate with Wazuh for event dashboards.
- Security Onion: Threat detection suite. Ingest lab traffic for threat hunting.
- Cowrie: SSH/telnet honeypot. Deploy isolated to monitor login attempts.
- WireGuard: VPN. Securely connect to lab network remotely.
- Sysmon: Windows logging. Install to track security events.
- Ansible: Automation tool. Push configs to multiple lab VMs.
- MITRE Caldera: Adversary emulation. Simulate attacker behavior in test networks.
- Wireshark: Packet capture/analysis. Inspect traffic between lab hosts. (Download)
- Zeek: Network monitoring/logging. Run with Security Onion for deep analysis. (Download)
- REMnux: Malware analysis distro. Reverse-engineer safely in VM. (Download)
- Sigma: Detection rules. Write rules & test in Wazuh/Graylog.
- Proxmox VE: Virtualization platform for running your lab VMs.
- Docker: Platform for developing, shipping, and running applications in containers.
- Portainer: Universal container management environment.
- Pi-hole: Network-wide ad blocking via your own Linux hardware.
- T-Pot: The All In One Honeypot Platform.
- HELK: The Hunting ELK - A Hunting Platform.
- Ghidra: A software reverse engineering (SRE) suite of tools developed by NSA.
- FlareVM: Windows-based security distribution for malware analysis, incident response, penetration testing, etc.
Threat Modeling Frameworks
- MITRE ATT&CK: A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
- Cyber Kill Chain: Developed by Lockheed Martin, this framework identifies what the adversaries must complete in order to achieve their objective.
- Diamond Model: A cognitive model for intrusion analysis.
- STRIDE: A threat modeling methodology developed by Microsoft (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).
- PASTA: Process for Attack Simulation and Threat Analysis, a risk-centric threat modeling methodology.
- LINDDUN: Privacy threat modeling framework (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance). (PILLAR AI Tool)
- OCTAVE: Operationally Critical Threat, Asset, and Vulnerability Evaluation, a risk-based strategic assessment and planning technique.
- VAST: Visual, Agile, and Simple Threat modeling, a scalable framework for DevOps and Agile.
- Trike: A risk-based threat modeling methodology and tool. (GitHub Repo)
- Attack Trees: Conceptual diagrams showing how an asset, or target, might be attacked. (ATTop Analysis Tool)
Threat Modeling Tools
- OWASP Threat Dragon: An open source threat modeling tool from OWASP.
- pytm: A Pythonic framework for threat modeling.
- Threagile: Agile Threat Modeling Toolkit.
- Threat Composer: A simple threat modeling tool to help humans to reduce time-to-value when threat modeling.
- Microsoft Threat Modeling Tool: A tool to create data flow diagrams to identify threats.
Blue Team Tools
Security Monitoring & SIEM
- Sysmon: Windows system monitor that tracks system activity and logs it to the Windows event log.
- Wazuh: Free and open source security platform that unifies XDR and SIEM capabilities.
- Security Onion: A free and open platform for threat hunting, enterprise security monitoring, and log management.
- Elastic Security (ELK): Unified protection for everyone.
- Velociraptor: Endpoint visibility and collection tool.
- SysmonSearch: Aggregates event logs generated by Microsoft's Sysmon.
Incident Response & Forensics
- TheHive: A scalable, open source and free Security Incident Response Platform.
- Cortex: Powerful Observable Analysis and Active Response Engine.
- SANS SIFT: SANS Investigative Forensic Toolkit.
- Autopsy: Digital forensics platform and graphical interface to The Sleuth Kit.
- Volatility: Advanced memory forensics framework.
- KAPE: Kroll Artifact Parser and Extractor.
Threat Intelligence
- MISP: Malware Information Sharing Platform and Threat Sharing.
- OpenCTI: Open Cyber Threat Intelligence Platform.
- YARA: The pattern matching swiss knife for malware researchers.
Analysis & Sandboxing
- Cuckoo Sandbox: Automated Malware Analysis System.
- CyberChef: The Cyber Swiss Army Knife.
- VirusTotal: Analyze suspicious files, domains, IPs and URLs.
Application Security
Detection Engineering
- Sigma: Generic Signature Format for SIEM Systems.
- Unprotect Project: Malware evasion techniques knowledge base.
- LOLBAS: Living Off The Land Binaries, Scripts and Libraries.
- GTFOBins: List of Unix binaries that can be used to bypass local security restrictions.