##.o0×X×0o.| D͓̽e͓̽a͓̽t͓̽h͓̽ R͓̽e͓̽s͓̽o͓̽u͓̽r͓̽c͓̽e͓̽s͓̽ |.o0×X×0o.##:

👾💻Description

In this repo, lets just say it can store everything what you are looking for. Maybe its relating to Cyber Operations including Detection Eng., Threat Hunting, Threat Intel, or Phishing. This Cyber space is broad, it includes various niches, often times they operate separately where they work individually, there are most times these teams work together. Its important that we incorporate for these teams to unify and be mindful that reframe from being siloed. There is a lot of overlapping in these niches. In order to explain some of the nuances and similarities between each niches. Personally, my learning style is visualizations and real-world analogies. Learning should be fun right? I don't know about you but I learn best from understanding and memorizing that relates to what I can relate to.

📚 Books

• Regular Expressions (Regex)
  • Introducing Regular Expressions: Unraveling Regular Expressions, Step-by-Step Paperback
  • Regular Expressions Cookbook: Detailed Solutions in Eight Programming Languages Paperback
  • Matering Regular Expressions 3rd Edition PDF. (Regex)
  • Mastering Regular Expressions (Regex) 3rd Edition Paperback

📄 Blogs

• Research - Detection and Response
  • SpecterOps: Introducing the Funnel of Fidelity by Jared Atkinson

📺 YouTube Playlist

• 🎯 Detection Engineering

  • Detection as Code: Detection Development Using CI/CD
  • Black Hills Information Security: The Detection Engineering Process w/ Hayden Covington
  • Maniant Managed Defense Leveling Up Your Detection Engineering

• 🎣 Phishing

  • Blacks Hills Information Security: MailFail: Who's Spoofing your Email, and How are they Doing it?

• Regular Expressions - Beginner

  • Regular Expressions (Regex) Tutorial
  • Introduction to Regular Expressions (Regex)

• 🏹🔎 Threat Hunt

  • Intel 471 Channel

---

🧠 Core Competency Stack

Domain	Core Skills
🎯 Detection Engineering	Detection logic, tuning, validation, Detection-as-Code
🕵️ Threat Hunting	Hypothesis-driven hunting, behavioral analysis
🧠 Threat Intelligence	IOC/TTP analysis, adversary research
🔬 Digital Forensics	Windows artifacts, DFIR, investigation
🪟 Windows Security	Internals, processes, persistence, execution
🔎 Query Engineering	KQL, Splunk, Regex
⚙️ Automation	PowerShell, scripting, CI/CD
📊 Telemetry	Logs, events, endpoint/network data
🧩 Frameworks	MITRE ATT&CK, Diamond Model, Pyramid of Pain
🛡️ Security Operations	Detection, investigation, response

---

🧭 Suggested Learning Path

1. Build the Fundamentals → TryHackMe Detection Engineering → MITRE ATT&CK → Pyramid of Pain → Diamond Model

2. Start Building Detections → Antisyphon SOC Detection Engineering → TCM Security Detection Engineering for Beginners

3. Build Supporting Skills → PowerShell → Regex → Splunk → KQL

4. Understand the Operating System → 13Cubed Digital Forensics → SANS Forensics

5. Develop Hunting & Intelligence Skills → Intel 471 → Huntress research

6. Advance Your Detection Engineering → SpecterOps Funnel of Fidelity → Level Effect — Death of Windows

🎯 Goal: Move beyond simply writing detection rules. Develop the ability to understand operating systems, execute and observe attacks, identify useful telemetry, investigate adversary behavior, and translate that knowledge into high-fidelity detections.

Build the technical depth to understand what happened, the analytical skill to determine why it matters, and the engineering discipline to turn that knowledge into high-fidelity detections.

🛡️ Detection Engineering — Hands-On Learning & Guidepoints

A curated collection of hands-on labs, courses, videos, and readings for developing practical Detection Engineering, Threat Hunting, Digital Forensics, and Security Operations skills.

---

🧭 Detection Engineering Learning Path

A practical progression from fundamentals to advanced Detection Engineering:

                    ┌───────────────────────┐
                    │     FUNDAMENTALS      │
                    │                       │
                    │ MITRE ATT&CK          │
                    │ Pyramid of Pain       │
                    │ Diamond Model         │
                    └───────────┬───────────┘
                                │
                                ▼
                    ┌───────────────────────┐
                    │  DETECTION DEVELOPMENT│
                    │                       │
                    │ Detection Engineering │
                    │ Detection-as-Code     │
                    │ Detection Logic       │
                    └───────────┬───────────┘
                                │
                                ▼
                    ┌───────────────────────┐
                    │   QUERY & AUTOMATION  │
                    │                       │
                    │ KQL                   │
                    │ Splunk                │
                    │ Regex                 │
                    │ PowerShell            │
                    └───────────┬───────────┘
                                │
                                ▼
                    ┌───────────────────────┐
                    │ OS & TELEMETRY        │
                    │                       │
                    │ Windows Internals     │
                    │ Digital Forensics     │
                    │ Security Artifacts    │
                    └───────────┬───────────┘
                                │
                                ▼
                    ┌───────────────────────┐
                    │ THREAT HUNTING        │
                    │                       │
                    │ Hypothesis Development│
                    │ Adversary Behavior    │
                    │ Threat Intelligence   │
                    └───────────┬───────────┘
                                │
                                ▼
                    ┌───────────────────────┐
                    │ ADVANCED DETECTION    │
                    │                       │
                    │ Detection Fidelity    │
                    │ Detection-as-Code     │
                    │ CI/CD                 │
                    │ Continuous Tuning     │
                    └───────────────────────┘

---

🎯 End Goal

Don't just learn how to write detection rules. Learn how to understand the adversary, the operating system, the telemetry, and the investigation process that makes a detection valuable.

The objective is to develop the ability to:

Understand the Attack

→ Execute / Emulate the Technique

→ Observe the Telemetry

→ Identify Relevant Artifacts

→ Develop a Detection

→ Validate the Detection

→ Tune for Fidelity

→ Operationalize

→ Hunt for Related Activity

→ Generate Intelligence

→ Improve the Detection

This creates a continuous feedback loop between Threat Intelligence → Threat Hunting → Detection Engineering → Incident Response → Intelligence.

                 ┌─────────────────────┐
                 │  THREAT INTELLIGENCE │
                 └──────────┬──────────┘
                            │
                            ▼
                 ┌─────────────────────┐
                 │   THREAT HUNTING    │
                 └──────────┬──────────┘
                            │
                            ▼
                 ┌─────────────────────┐
                 │ DETECTION ENGINEERING│
                 └──────────┬──────────┘
                            │
                            ▼
                 ┌─────────────────────┐
                 │ INCIDENT RESPONSE   │
                 └──────────┬──────────┘
                            │
                            ▼
                 ┌─────────────────────┐
                 │   NEW INTELLIGENCE  │
                 └──────────┬──────────┘
                            │
                            └──────────────► ♻️ Recycle Phase/Loop ♻️

Core Philosophy:

Intelligence drives hypotheses. Hypotheses drive hunts. Hunts generate telemetry. Telemetry drives detections. Detections generate investigations. Investigations produce intelligence.

🚀 Detection Engineering — Hands-On Labs & Courses

Resource	Focus	Level
Antisyphon Training — SOC Detection Engineering Crash Course	SOC detection engineering, lab simulation, VM-based exercises	🟢 Easy → 🟡 Moderate
TryHackMe — Detection Engineering	Detection engineering fundamentals, MITRE ATT&CK, Pyramid of Pain, Diamond Model	🟢 Beginner
TCM Security — Detection Engineering for Beginners	Build a detection lab, execute attacks, and develop detections from observed activity	🟡 Moderate
Level Effect — Course Options	Advanced Windows security, detection, and threat hunting concepts	🟢 Easy → 🟡 Moderate

---

🧰 Supporting Technical Skills

⚡ PowerShell

PowerShell Quick Course — YouTube

Build foundational PowerShell skills for Windows administration, investigation, automation, and detection development.

🔎 Regular Expressions & Splunk

Lame Creations — Regex & Splunk Guides

Useful material for developing regex skills and working with Splunk searches and detection logic.

🖥️ KQL / Microsoft Security

KC7 Cyber — KQL Training

Hands-on training for learning Kusto Query Language (KQL) and applying query skills to security investigations and threat hunting.

---

🔬 Digital Forensics & Operating System Knowledge

13Cubed — Digital Forensics

Excellent resource for understanding Windows internals, digital forensics, artifacts, and investigative techniques.

Understanding how an operating system works—and what traces activity leaves behind—is critical for developing effective detections.

---

🕵️ Threat Hunting & Threat Intelligence

🎥 SANS Forensics

SANS Forensics — YouTube

Additional lectures, presentations, and technical content covering digital forensics, incident response, and investigative methodologies.

---

🐇 Huntress Blog

Huntress — Security Research & Threat Intelligence

Ongoing research and write-ups covering threat actors, malware, incidents, adversary techniques, and practical security operations.

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀