Tag

Blueteam

1 brief RSS

SOC Analyst Toolkit with Threat Hunting Queries

A free, offline SOC toolkit aimed at Tier 1 analysts includes IR checklists, triage playbooks, and threat hunting guides mapped to MITRE ATT&CK, with Splunk and Elastic queries for threats such as Kerberoasting, Pass-the-Hash, LOLBAS, scheduled task persistence, and C2 on non-standard ports.

soc blueteam threat-hunting

2r 1t 2i Mar 18, 2026