Threat Hunting & Detection Tools logopeterindia.net
Knowledge Hub

Threat Hunting & Detection Tools

References, analysis tools and rule sets for finding attacker activity, from LOLBAS and GTFOBins to Chainsaw and KQL Search.

22 topics•5 categories•Updated November 2026

Living-off-the-Land References

3 entries

Catalogs of legitimate binaries and drivers that attackers abuse.

01LOLBASWindows living-off-the-land techniques. A curated list of Microsoft-signed binaries, scripts and libraries that can be abused for execution, download, bypass and persistence, with ATT&CK mappings and detection notes. 02GTFOBinsUnix binary abuse techniques. A curated list of Unix binaries that can be used to bypass local restrictions, escalate privileges, read or write files and spawn shells. 03LOLDriversCommunity catalog of Windows drivers that have been abused by attackers, including vulnerable and malicious drivers, with hashes and detection content.

Forensic Artifact Analysis

4 entries

Hunt through event logs and artifacts quickly.

04ChainsawWindows forensic artifact analysis. Rust-based tool for fast searching of Windows event logs and other artifacts, with Sigma rule support and built-in detection logic for hunting. 05HayabusaWindows event log fast forensics timeline generator and threat hunting tool that applies Sigma-based rules to build timelines. 06DeepBlueCLIPowerShell module from SANS Blue Team for hunting suspicious activity in Windows event logs. 07YARAPattern-matching tool for identifying and classifying malware and other files using text or binary rules.

Detection Rules & Queries

4 entries

Reusable detection content for SIEM and EDR platforms.

08KQL SearchDetection query resources. A searchable collection of Kusto Query Language (KQL) queries for threat hunting and detection in Microsoft Defender and Microsoft Sentinel. 09SigmaOpen generic rule format for log events, with a large community rule repository that can be converted into queries for many SIEM and EDR products. 10Elastic Detection RulesElastic's open repository of detection rules for Elastic Security, covering many ATT&CK techniques. 11Splunk Security ContentSplunk Threat Research Team's detections, analytic stories and playbooks for Splunk.

Frameworks & Adversary Emulation

3 entries

Map behaviors to techniques and test your coverage.

12MITRE ATT&CKKnowledge base of adversary tactics and techniques based on real-world observations, widely used to structure hunts and measure detection coverage. 13ATT&CK NavigatorWeb tool for annotating and visualizing ATT&CK matrices, useful for tracking detection coverage and hunt plans. 14Atomic Red TeamLibrary of small, portable tests mapped to ATT&CK that let you check whether your detections fire.

Related Pages

8 entries

Related directories on this site.

15Security Monitoring ToolsSysmon, Kibana, Velociraptor and more. 16SIEM SoftwareSecurity information and event management platforms. 17XDR SoftwareExtended detection and response platforms. 18Cyberthreat Intelligence PlatformsThreat intelligence platforms. 19Security IR ToolsIncident response tools. 20Penetration Testing ToolsTools used to test systems and networks. 21Network Discovery & Mapping ToolsNmap, Nuclei, Shodan and related tools. 22CybersecurityHub of cybersecurity directories: SIEM, XDR, zero trust, cloud, application and AI security.

Frequently Asked Questions

What is threat hunting?

Proactively searching logs, endpoints and networks for attacker activity that automated alerts missed, usually starting from a hypothesis such as a known technique.

What is detection engineering?

Designing, writing, testing and tuning detection rules and queries so that malicious behavior triggers reliable alerts with few false positives.

What is LOLBAS?

LOLBAS lists Windows binaries, scripts and libraries that ship with the operating system or are signed, yet can be abused by attackers. Defenders use it to build detections for living-off-the-land activity.

What is GTFOBins?

GTFOBins is the Unix counterpart: a list of common binaries that can be abused to escape restricted shells, escalate privileges or transfer files.

What does Chainsaw do?

Chainsaw searches and hunts through Windows event logs and forensic artifacts quickly, applying Sigma rules and built-in detections to surface suspicious events.

What is KQL Search?

A searchable library of Kusto Query Language queries for hunting and detection in Microsoft security products such as Defender and Sentinel.

How do these resources work together?

Use LOLBAS, GTFOBins and ATT&CK to decide what to look for, Sigma and KQL queries to express it, Chainsaw or Hayabusa to search collected logs, and Atomic Red Team to check that detections fire.

Can these tools be misused?

Yes. LOLBAS and GTFOBins describe techniques attackers use, and are published so defenders can detect them. Run tests only on systems you own or are authorized to test.

How were these tools chosen?

The page lists widely used references, analysis tools and rule sets for hunting and detection. Descriptions summarize each project's own documentation, so verify current features and licensing.