CIPHER Defensive Synthesis Reference

Generated: 2026-03-14 | Classification: Training Reference Cross-references MITRE ATT&CK v15, NIST CSF 2.0, CIS Controls v8

---

1. Detection Coverage Matrix — Top 50 MITRE ATT&CK Techniques

Initial Access

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
1	Phishing: Spearphishing Attachment	T1566.001	Email gateway, endpoint	file_event, process_creation	EmailEvents | where AttachmentCount > 0 and ThreatTypes has "Phish"	index=email sourcetype=esa action=quarantine	4688	1, 11, 15	Easy
2	Exploit Public-Facing Application	T1190	WAF, web server, IDS/IPS	webserver	W3CIISLog | where scStatus >= 400 and scStatus < 500 | summarize count() by cIP, csUriStem	index=web sourcetype=iis status>=400 | stats count by src_ip, uri_path	IIS logs	3 (network conn)	Medium
3	Valid Accounts	T1078	AD, IAM, VPN, cloud auth	authentication	SigninLogs | where ResultType == 0 and RiskLevelDuringSignIn != "none"	index=auth action=success | stats dc(src_ip) by user	4624, 4625, 4648	—	Hard
4	External Remote Services	T1133	VPN, RDP gateway, firewall	network_connection	SigninLogs | where AppDisplayName has "VPN" and Location != "expected_country"	index=vpn action=success | iplocation src_ip	4624 (Type 10)	3	Medium
5	Supply Chain Compromise	T1195	Package managers, CI/CD, endpoint	process_creation	DeviceProcessEvents | where InitiatingProcessFileName in ("npm","pip","nuget")	index=endpoint process_name IN ("npm","pip") | stats count by parent_process, hash	4688	1, 7	Hard
6	Drive-by Compromise	T1189	Proxy, DNS, endpoint	proxy, dns_query	DeviceNetworkEvents | where RemoteUrl matches regex @"[a-z]{20,}\.(?:top|xyz|tk)"	index=proxy category=malicious | stats count by dest_domain, src_ip	—	1, 3, 22	Hard
7	Trusted Relationship	T1199	Cloud audit, IAM, VPN	cloud	AuditLogs | where OperationName == "Add partner to cross-tenant access setting"	index=cloud sourcetype=azure:audit operation="Add partner*"	4624	—	Hard

Execution

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
8	Command and Scripting Interpreter: PowerShell	T1059.001	PowerShell logging, endpoint	process_creation, ps_script	DeviceProcessEvents | where FileName == "powershell.exe" and ProcessCommandLine has_any("-enc","-e ","-ep bypass")	index=win sourcetype=WinEventLog:Microsoft-Windows-PowerShell/Operational EventCode=4104 | regex ScriptBlockText="(?i)(invoke-expression|iex|downloadstring)"	4103, 4104, 4688	1	Easy
9	Command and Scripting Interpreter: cmd	T1059.003	Process auditing	process_creation	DeviceProcessEvents | where FileName == "cmd.exe" and ProcessCommandLine has_any("/c ","/k ")	index=win EventCode=4688 New_Process_Name="*\\cmd.exe"	4688	1	Easy
10	Windows Management Instrumentation	T1047	WMI trace, process auditing	process_creation	DeviceProcessEvents | where FileName == "wmic.exe" or InitiatingProcessFileName == "wmiprvse.exe"	index=win EventCode=4688 (New_Process_Name="*\\wmic.exe" OR New_Process_Name="*\\wmiprvse.exe")	4688, 5861	1, 20, 21	Medium
11	Scheduled Task/Job	T1053.005	Task Scheduler, process auditing	process_creation	DeviceProcessEvents | where FileName == "schtasks.exe" and ProcessCommandLine has "/create"	index=win (EventCode=4698 OR (EventCode=4688 New_Process_Name="*\\schtasks.exe"))	4698, 4699, 4700, 4702	1	Easy
12	User Execution: Malicious File	T1204.002	Endpoint, email	file_event, process_creation	DeviceProcessEvents | where InitiatingProcessFileName in ("winword.exe","excel.exe") and FileName in ("cmd.exe","powershell.exe","wscript.exe")	index=endpoint parent_process_name IN ("winword.exe","excel.exe") process_name IN ("cmd.exe","powershell.exe")	4688	1, 11	Easy
13	Native API	T1106	EDR, ETW	process_access	DeviceEvents | where ActionType == "NtAllocateVirtualMemory" or ActionType == "CreateRemoteThread"	index=edr sourcetype=sysmon EventCode=8	—	8, 10	Hard
14	Inter-Process Communication: DDE	T1559.002	Process auditing	process_creation	DeviceProcessEvents | where InitiatingProcessFileName in ("excel.exe","winword.exe") and FileName != "splwow64.exe"	index=endpoint parent_process IN ("excel.exe","winword.exe") NOT process_name="splwow64.exe"	4688	1	Medium

Persistence

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
15	Registry Run Keys / Startup Folder	T1547.001	Registry auditing, Sysmon	registry_set	DeviceRegistryEvents | where RegistryKey has_any("\\Run","\\RunOnce") and ActionType == "RegistryValueSet"	index=win sourcetype=sysmon EventCode=13 TargetObject="*\\CurrentVersion\\Run*"	4657	12, 13, 14	Easy
16	Create Account	T1136.001	Security log	—	SecurityEvent | where EventID == 4720	index=win EventCode=4720	4720, 4722, 4738	—	Easy
17	Boot or Logon Autostart: Services	T1543.003	Service Control Manager	process_creation	DeviceProcessEvents | where FileName == "sc.exe" and ProcessCommandLine has "create"	index=win EventCode=7045	7045, 4697	1	Easy
18	Server Software Component: Web Shell	T1505.003	Web server, file integrity	file_event	DeviceFileEvents | where FolderPath has_any("\\inetpub\\","\\www\\") and FileName endswith_cs_any(".aspx",".jsp",".php")	index=endpoint file_path IN ("*\\inetpub\\*","*/www/*") file_name IN ("*.aspx","*.jsp","*.php")	—	11	Medium
19	BITS Jobs	T1197	BITS log, Sysmon	process_creation	DeviceProcessEvents | where FileName == "bitsadmin.exe" and ProcessCommandLine has_any("/transfer","/create")	index=win EventCode=4688 New_Process_Name="*\\bitsadmin.exe"	59-61 (BITS)	1	Medium
20	Office Application Startup	T1137	File events, registry	registry_set, file_event	DeviceRegistryEvents | where RegistryKey has "\\Office\\*\\Security" or RegistryKey has "\\Addins"	index=win sourcetype=sysmon EventCode=13 TargetObject="*\\Office\\*"	—	11, 13	Medium
21	Event Triggered Execution: WMI Sub	T1546.003	WMI trace	wmi_event	DeviceEvents | where ActionType == "WmiBindingEvent"	index=win sourcetype=sysmon EventCode IN (19,20,21)	5861	19, 20, 21	Medium

Privilege Escalation

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
22	Process Injection	T1055	EDR, Sysmon	process_access	DeviceEvents | where ActionType in ("CreateRemoteThreadApiCall","QueueUserApcRemoteApiCall")	index=win sourcetype=sysmon EventCode IN (8,10)	—	8, 10	Hard
23	Abuse Elevation Control: UAC Bypass	T1548.002	Process auditing	process_creation	DeviceProcessEvents | where FileName in ("fodhelper.exe","eventvwr.exe","sdclt.exe") and InitiatingProcessFileName != "explorer.exe"	index=win EventCode=4688 New_Process_Name IN ("*\\fodhelper.exe","*\\eventvwr.exe") NOT Parent_Process="*\\explorer.exe"	4688	1	Medium
24	Access Token Manipulation	T1134	Process auditing, ETW	process_creation	DeviceProcessEvents | where ProcessCommandLine has_any("runas /netonly","token::elevate")	index=win EventCode=4688 CommandLine="*runas*/netonly*"	4624 (Type 9), 4648	1, 10	Hard
25	Exploitation for Privilege Escalation	T1068	EDR, crash dumps	process_creation	DeviceEvents | where ActionType == "ExploitGuardElevation"	index=edr exploit_prevention=true	—	1 (unusual child)	Hard

Defense Evasion

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
26	Obfuscated Files or Information	T1027	Script block logging, EDR	ps_script	DeviceProcessEvents | where ProcessCommandLine matches regex @"[A-Za-z0-9+/=]{100,}"	index=win EventCode=4104 ScriptBlockText="*[Convert]::FromBase64*"	4104	1	Medium
27	Masquerading	T1036.005	Process auditing, Sysmon	process_creation	DeviceProcessEvents | where FileName == "svchost.exe" and not(FolderPath startswith "C:\\Windows\\System32")	index=win EventCode=4688 process_name=svchost.exe NOT process_path="C:\\Windows\\System32\\*"	4688	1	Medium
28	Indicator Removal: Clear Event Logs	T1070.001	Security log	—	SecurityEvent | where EventID == 1102	index=win EventCode=1102	1100, 1102	—	Easy
29	Disable or Modify Tools	T1562.001	Security log, EDR	process_creation	DeviceProcessEvents | where ProcessCommandLine has_any("Set-MpPreference -DisableRealtimeMonitoring","sc stop WinDefend")	index=win EventCode=4688 CommandLine="*Set-MpPreference*Disable*"	4688, 5001 (Defender)	1	Easy
30	Signed Binary Proxy Execution: Rundll32	T1218.011	Process auditing	process_creation	DeviceProcessEvents | where FileName == "rundll32.exe" and ProcessCommandLine has_any("javascript:","http://","shell32.dll,Control_RunDLL")	index=win process_name=rundll32.exe CommandLine IN ("*javascript:*","*http://*")	4688	1	Medium
31	Signed Binary Proxy Execution: Mshta	T1218.005	Process auditing	process_creation	DeviceProcessEvents | where FileName == "mshta.exe"	index=win EventCode=4688 New_Process_Name="*\\mshta.exe"	4688	1	Easy
32	Impair Defenses: Disable Windows Event Logging	T1562.002	Security log, registry	registry_set	SecurityEvent | where EventID == 1102 or (EventID == 4719 and AuditPolicyChanges has "removed")	index=win (EventCode=1102 OR EventCode=4719)	1102, 4719	13	Easy
33	Modify Authentication Process	T1556	Security log, file integrity	file_event	DeviceFileEvents | where FolderPath has "\\System32\\" and FileName has_any("lsass","msv1","wdigest")	index=win sourcetype=sysmon EventCode=11 TargetFilename="*\\System32\\*" file_name IN ("*lsass*","*msv1*")	—	11	Hard

Credential Access

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
34	OS Credential Dumping: LSASS Memory	T1003.001	EDR, Sysmon	process_access	DeviceProcessEvents | where FileName in ("procdump.exe","mimikatz.exe") or (ActionType == "OpenProcess" and TargetProcessName == "lsass.exe")	index=win sourcetype=sysmon EventCode=10 TargetImage="*\\lsass.exe" GrantedAccess IN ("0x1010","0x1410","0x1fffff")	—	10	Medium
35	Brute Force	T1110	Security log, IAM	authentication	SecurityEvent | where EventID == 4625 | summarize FailCount=count() by TargetUserName, bin(TimeGenerated, 5m) | where FailCount > 10	index=win EventCode=4625 | stats count by user _time span=5m | where count>10	4625, 4771	—	Easy
36	Credentials from Password Stores	T1555	Process auditing	process_creation, file_event	DeviceProcessEvents | where ProcessCommandLine has_any("vaultcmd","cmdkey /list","chrome --headless")	index=endpoint process_name IN ("vaultcmd.exe","cmdkey.exe") OR CommandLine="*chrome*headless*password*"	4688	1	Medium
37	Kerberoasting	T1558.003	Security log	—	SecurityEvent | where EventID == 4769 and TicketEncryptionType == "0x17" and ServiceName !endswith "$"	index=win EventCode=4769 Ticket_Encryption_Type=0x17 Service_Name!="*$"	4769	—	Medium
38	DCSync	T1003.006	Security log, DC replication	—	SecurityEvent | where EventID == 4662 and Properties has_any("1131f6aa-","1131f6ad-")	index=win EventCode=4662 Properties IN ("*1131f6aa*","*1131f6ad*") NOT Account_Name="*$"	4662	—	Medium

Discovery

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
39	System Information Discovery	T1082	Process auditing	process_creation	DeviceProcessEvents | where FileName in ("systeminfo.exe","hostname.exe") or ProcessCommandLine has "Get-ComputerInfo"	index=win EventCode=4688 New_Process_Name IN ("*\\systeminfo.exe","*\\hostname.exe")	4688	1	Easy
40	Account Discovery	T1087	Process auditing	process_creation	DeviceProcessEvents | where ProcessCommandLine has_any("net user","net group","Get-ADUser","whoami")	index=win EventCode=4688 CommandLine IN ("*net user*","*net group*","*whoami*")	4688	1	Easy
41	Network Service Discovery	T1046	Firewall, IDS, Sysmon	network_connection	DeviceNetworkEvents | summarize PortCount=dcount(RemotePort) by DeviceName, RemoteIP, bin(Timestamp, 1m) | where PortCount > 20	index=firewall | stats dc(dest_port) as port_count by src_ip dest_ip | where port_count>20	—	3	Medium
42	Permission Groups Discovery	T1069	Process auditing	process_creation	DeviceProcessEvents | where ProcessCommandLine has_any("net localgroup","Get-ADGroupMember","gpresult")	index=win EventCode=4688 CommandLine IN ("*net localgroup*","*Get-ADGroupMember*")	4688	1	Easy

Lateral Movement

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
43	Remote Services: RDP	T1021.001	Security log, Sysmon	authentication, network_connection	SecurityEvent | where EventID == 4624 and LogonType == 10	index=win EventCode=4624 Logon_Type=10	4624 (Type 10), 4778, 4779	3	Easy
44	Remote Services: SMB/Windows Admin Shares	T1021.002	Security log, Sysmon	network_connection	SecurityEvent | where EventID == 5140 and ShareName in ("\\\\*\\C$","\\\\*\\ADMIN$")	index=win EventCode=5140 Share_Name IN ("\\\\*\\C$","\\\\*\\ADMIN$")	5140, 5145	3	Medium
45	Lateral Tool Transfer	T1570	File events, Sysmon	file_event	DeviceFileEvents | where FolderPath has_any("\\ADMIN$","\\C$") and FileName endswith_any(".exe",".dll",".ps1")	index=win sourcetype=sysmon EventCode=11 TargetFilename IN ("*\\ADMIN$\\*","*\\C$\\*")	5145	11	Medium
46	Remote Services: WinRM	T1021.006	PowerShell logging, Security log	process_creation, network_connection	DeviceProcessEvents | where FileName == "wsmprovhost.exe"	index=win EventCode=4688 New_Process_Name="*\\wsmprovhost.exe"	4688, 91 (WinRM)	1, 3	Medium

Collection, Exfiltration, Command and Control

#	Technique	ATT&CK ID	Required Log Sources	Sigma Category	KQL Reference	SPL Reference	Windows Event IDs	Sysmon Event IDs	Difficulty
47	Archive Collected Data	T1560.001	Process auditing	process_creation	DeviceProcessEvents | where FileName in ("7z.exe","rar.exe","zip.exe") or ProcessCommandLine has "Compress-Archive"	index=win EventCode=4688 process_name IN ("7z.exe","rar.exe","zip.exe")	4688	1	Easy
48	Exfiltration Over Web Service	T1567	Proxy, firewall, DLP	network_connection, proxy	DeviceNetworkEvents | where RemoteUrl has_any("mega.nz","anonfiles","dropmefiles","transfer.sh") and SentBytes > 10000000	index=proxy dest IN ("mega.nz","anonfiles.com","transfer.sh") bytes_out>10000000	—	3, 22	Medium
49	Application Layer Protocol: DNS	T1071.004	DNS, Sysmon	dns_query	DnsEvents | where QueryType in ("TXT","NULL") or strlen(Name) > 50 | summarize count() by ClientIP, bin(TimeGenerated, 5m) | where count_ > 50	index=dns (query_type=TXT OR query_type=NULL OR record_type=TXT) | eval len=len(query) | where len>50	—	22	Hard
50	Ingress Tool Transfer	T1105	Proxy, Sysmon, EDR	network_connection, process_creation	DeviceProcessEvents | where ProcessCommandLine has_any("certutil -urlcache","wget","curl","Invoke-WebRequest","bitsadmin /transfer")	index=win EventCode=4688 CommandLine IN ("*certutil*urlcache*","*wget*","*curl*","*Invoke-WebRequest*")	4688	1, 3, 11	Easy

Coverage Summary

Tactic	Techniques Covered	Avg Difficulty	Critical Log Sources
Initial Access	7	Medium-Hard	Email gateway, WAF, IAM, proxy
Execution	7	Easy-Medium	PowerShell logging (4103/4104), Sysmon EventCode 1, process auditing (4688)
Persistence	7	Easy-Medium	Registry auditing (Sysmon 12/13/14), service logs (7045), file monitoring (Sysmon 11)
Privilege Escalation	4	Medium-Hard	Sysmon 8/10 (process injection), ETW, process auditing
Defense Evasion	8	Easy-Medium	Script block logging (4104), Sysmon 1, security log (1102)
Credential Access	5	Easy-Medium	Security log (4625/4769/4662), Sysmon 10 (LSASS access)
Discovery	4	Easy	Process auditing (4688), Sysmon 1/3
Lateral Movement	4	Easy-Medium	Security log (4624/5140), Sysmon 3/11
Collection/Exfil/C2	4	Easy-Hard	Proxy, DNS, DLP, Sysmon 22

Minimum Viable Logging for Detection

Without these sources, coverage drops catastrophically:

1. Windows Security Log (4624, 4625, 4648, 4662, 4688, 4698, 4720, 4769, 5140) — enable command-line auditing
2. Sysmon (all events, especially 1, 3, 7, 8, 10, 11, 12/13/14, 22) — use SwiftOnSecurity or Olaf Hartong config
3. PowerShell Script Block Logging (4103, 4104) — GPO: Turn on PowerShell Script Block Logging
4. DNS query logging (Sysmon 22 or DNS Debug Logging)
5. Proxy/firewall logs with full URL and bytes transferred

---

2. Security Architecture Decision Trees

2.1 New SaaS Application Design

START: New SaaS Application
|
+-- [1] Data Classification
|   |-- What data will be processed?
|   |   +-- PII/PHI/PCI --> Encryption at rest + in transit mandatory
|   |   |                   Data residency requirements? --> Region-locked deployment
|   |   |                   Regulatory scope: GDPR/HIPAA/PCI-DSS
|   |   +-- Business confidential --> Encryption at rest, TLS 1.2+ in transit
|   |   +-- Public --> TLS in transit, integrity verification
|   |
+-- [2] Authentication & Identity
|   |-- Multi-tenant?
|   |   +-- Yes --> Tenant isolation model:
|   |   |          +-- Silo (separate DB per tenant) --> Strongest isolation, highest cost
|   |   |          +-- Bridge (shared DB, row-level security) --> Cost effective, needs careful RLS
|   |   |          +-- Pool (shared everything) --> Only for non-sensitive data
|   |   +-- No --> Single-tenant auth
|   |-- Auth provider:
|   |   +-- Build custom auth --> NO. Use established IdP (Auth0, Entra ID, Cognito)
|   |   +-- Social login only --> Add MFA requirement for elevated actions
|   |   +-- Enterprise SSO --> SAML 2.0 / OIDC, support SCIM provisioning
|   |-- Session management:
|       +-- Stateless JWT --> Short-lived (15min), refresh token rotation, token binding
|       +-- Stateful sessions --> Server-side store, secure cookie flags (HttpOnly, Secure, SameSite=Strict)
|
+-- [3] API Security
|   +-- All APIs --> Rate limiting, input validation, output encoding
|   +-- Public APIs --> OAuth 2.0 + API keys, abuse detection
|   +-- Internal APIs --> mTLS, service mesh, no API keys in code
|   +-- Webhook receivers --> Signature verification (HMAC-SHA256), idempotency
|
+-- [4] Infrastructure
|   +-- Compute: containers (ECS/GKE) preferred over VMs for immutability
|   +-- Secrets: Vault / AWS Secrets Manager / Azure Key Vault (never env vars in code)
|   +-- WAF: OWASP CRS ruleset minimum, custom rules for business logic
|   +-- CDN: Origin shielding, DDoS protection (CloudFlare/AWS Shield)
|
+-- [5] Security Testing Pipeline
|   +-- Pre-commit: secrets scanning (gitleaks/trufflehog)
|   +-- CI: SAST (Semgrep), SCA (Dependabot/Snyk), container scan (Trivy)
|   +-- CD: DAST (OWASP ZAP), infrastructure scan
|   +-- Production: Bug bounty, annual pentest, continuous monitoring
|
+-- [6] Logging & Monitoring
|   +-- Structured logging (JSON) --> SIEM ingestion
|   +-- Auth events, access decisions, data access (audit trail)
|   +-- Anomaly detection on API usage patterns
|   +-- Alerting: failed auth spikes, privilege escalation, data exfil indicators
|
+-- DECISION OUTPUT:
    +-- Architecture Decision Record (ADR) documenting each choice
    +-- Threat model (STRIDE) before first line of code
    +-- Security requirements in acceptance criteria

2.2 Microservices Migration

START: Monolith --> Microservices
|
+-- [1] Identify Security Boundaries
|   +-- Map existing auth flows --> Which services need user context?
|   +-- Map data flows --> Where does sensitive data cross boundaries?
|   +-- Identify trust boundaries --> Internal vs external, privilege levels
|
+-- [2] Service-to-Service Authentication
|   |-- Option A: Service Mesh (Istio/Linkerd)
|   |   +-- mTLS automatic between services
|   |   +-- Authorization policies at mesh layer
|   |   +-- BEST for: large deployments, polyglot services
|   |-- Option B: JWT propagation
|   |   +-- API gateway validates, propagates claims
|   |   +-- Services validate JWT signature + claims
|   |   +-- BEST for: smaller deployments, uniform tech stack
|   |-- Option C: mTLS + OAuth2 client credentials
|   |   +-- Certificate-based identity + scoped tokens
|   |   +-- BEST for: high-security environments
|   +-- NEVER: shared secrets, API keys in config, no auth between services
|
+-- [3] Data Isolation
|   +-- Database per service (preferred) --> No cross-service DB queries
|   +-- Shared DB with schema separation --> Acceptable interim step
|   +-- Event-driven data sync --> Saga pattern for transactions
|   +-- Encrypt PII at the owning service --> Other services get tokens/references
|
+-- [4] API Gateway Security
|   +-- Centralized: rate limiting, auth, input validation, request logging
|   +-- mTLS termination at gateway, re-encryption to services
|   +-- Circuit breaker pattern to prevent cascade failures
|
+-- [5] Secrets Management
|   +-- Centralized vault (HashiCorp Vault, cloud-native KMS)
|   +-- Dynamic secrets with TTL (DB creds, API keys)
|   +-- No secrets in container images, env vars only from vault injection
|
+-- [6] Observability for Security
|   +-- Distributed tracing (Jaeger/Zipkin) --> Detect anomalous call patterns
|   +-- Centralized logging with correlation IDs
|   +-- Service dependency map --> Attack path visualization
|
+-- MIGRATION ORDER:
    1. API gateway + auth service first
    2. Logging/monitoring infrastructure
    3. Extract services starting with least-coupled
    4. Security testing at each extraction step

2.3 Cloud Migration (On-Prem to AWS/Azure/GCP)

START: Cloud Migration
|
+-- [1] Cloud Provider Selection (Security Lens)
|   +-- Regulatory constraints?
|   |   +-- FedRAMP --> AWS GovCloud / Azure Gov
|   |   +-- Data sovereignty (EU) --> Region-locked, check provider DPA
|   |   +-- HIPAA --> BAA required (all three support)
|   +-- Existing identity provider?
|   |   +-- Active Directory heavy --> Azure (Entra ID integration)
|   |   +-- Google Workspace --> GCP
|   |   +-- Neutral --> AWS (largest ecosystem)
|
+-- [2] Identity & Access Management
|   +-- Federate corporate IdP --> SSO to cloud console
|   +-- Least privilege IAM policies from day one
|   +-- No long-lived access keys --> Use roles/workload identity
|   +-- Separate accounts/subscriptions/projects per environment
|   +-- Break-glass procedure for emergency access
|
+-- [3] Network Architecture
|   +-- Landing zone pattern (AWS Control Tower / Azure Landing Zone / GCP Foundation)
|   +-- Hub-spoke or transit gateway topology
|   +-- Private subnets for workloads, public only for load balancers
|   +-- VPN/DirectConnect/ExpressRoute for hybrid connectivity
|   +-- DNS: split-horizon, no internal names resolvable externally
|   +-- Egress filtering: explicit allow-list, no unrestricted outbound
|
+-- [4] Data Protection
|   +-- Encryption at rest: cloud-managed keys (minimum), CMK (preferred), BYOK (high security)
|   +-- Encryption in transit: TLS 1.2+ everywhere, mTLS for service-to-service
|   +-- Data classification tags on all storage resources
|   +-- DLP scanning on storage buckets/blobs
|   +-- Backup encryption with separate key management
|
+-- [5] Security Tooling Stack
|   +-- CSPM: AWS Security Hub / Azure Defender / GCP SCC
|   +-- Cloud-native WAF + DDoS protection
|   +-- Flow logs / VPC logs --> SIEM
|   +-- CloudTrail / Activity Log / Cloud Audit Logs --> SIEM
|   +-- GuardDuty / Sentinel / Chronicle for threat detection
|
+-- [6] Migration Phases (Security Gating)
    Phase 0: Landing zone + security baseline (CIS Benchmark)
    Phase 1: Non-sensitive workloads, validate controls
    Phase 2: Sensitive workloads with full audit trail
    Phase 3: Decommission on-prem, close hybrid attack surface
    Each phase: security review gate before promotion

2.4 API-First Application

START: API-First Application
|
+-- [1] API Design Security
|   +-- OpenAPI/Swagger spec --> Security schemes defined in spec
|   +-- Versioning strategy (URI vs header) --> Deprecation = security patching window
|   +-- Input validation at schema level (JSON Schema, max lengths, patterns)
|   +-- Output filtering: never return more fields than needed
|
+-- [2] Authentication Model
|   +-- Consumer type?
|   |   +-- End users (browser/mobile) --> OAuth 2.0 Authorization Code + PKCE
|   |   +-- Server-to-server --> OAuth 2.0 Client Credentials
|   |   +-- Third-party developers --> API keys + OAuth 2.0 (scoped)
|   |   +-- Internal services --> mTLS + service accounts
|   +-- Token format:
|       +-- Opaque tokens + introspection --> Better revocation, more latency
|       +-- JWT --> Stateless validation, harder revocation (use short TTL + blocklist)
|
+-- [3] Authorization
|   +-- RBAC minimum, ABAC for fine-grained
|   +-- Authorization at API gateway (coarse) + service (fine-grained)
|   +-- Broken Object Level Authorization (BOLA/IDOR) prevention:
|       +-- Validate resource ownership on every request
|       +-- Use UUIDs not sequential IDs
|       +-- Automated BOLA testing in CI
|
+-- [4] Rate Limiting & Abuse Prevention
|   +-- Per-consumer rate limits (token bucket)
|   +-- Separate limits for auth endpoints (stricter)
|   +-- Cost-based rate limiting for expensive operations
|   +-- Bot detection for public APIs
|
+-- [5] API Security Testing
|   +-- Contract testing: schema validation in CI
|   +-- DAST: OWASP ZAP API scan mode
|   +-- Fuzzing: RESTler, Schemathesis
|   +-- BOLA scanner: custom or AuthMatrix (Burp)
|
+-- [6] API Gateway Checklist
    [ ] TLS 1.2+ termination
    [ ] Request size limits
    [ ] Content-Type validation
    [ ] CORS policy (explicit origins, not *)
    [ ] Security headers (X-Content-Type-Options, X-Frame-Options, CSP)
    [ ] Request/response logging (redact sensitive fields)
    [ ] Circuit breaker for downstream failures

2.5 Zero Trust Implementation (Mid-Size Enterprise)

START: Zero Trust for Mid-Size Enterprise (500-5000 employees)
|
+-- [1] Maturity Assessment
|   +-- Current state: traditional perimeter? partial ZT? hybrid?
|   +-- Identity maturity: MFA deployed? SSO? lifecycle management?
|   +-- Device management: MDM? health checks? BYOD policy?
|   +-- Network: flat? segmented? micro-segmented?
|
+-- [2] Identity Pillar (Phase 1 - Start Here)
|   +-- Single IdP for all users (Entra ID / Okta / Google)
|   +-- MFA mandatory, phishing-resistant preferred (FIDO2/passkeys)
|   +-- Conditional access policies:
|   |   +-- Device compliance required
|   |   +-- Location-based (block impossible travel)
|   |   +-- Risk-based (step-up auth for anomalies)
|   +-- Privileged access: PAM solution, JIT access, session recording
|   +-- Service accounts: no shared passwords, managed identities
|
+-- [3] Device Pillar (Phase 2)
|   +-- Device inventory: all endpoints enrolled in MDM
|   +-- Health attestation before access (OS patched, AV running, disk encrypted)
|   +-- BYOD: separate access tier, MAM for corporate data
|   +-- Certificate-based device identity
|
+-- [4] Network Pillar (Phase 3)
|   +-- Micro-segmentation: identity-based not IP-based
|   +-- SDP/ZTNA replacing VPN (Zscaler/Cloudflare Access/Tailscale)
|   +-- East-west traffic inspection
|   +-- DNS filtering for all endpoints
|   +-- Encrypted DNS (DoH/DoT) to managed resolver only
|
+-- [5] Application & Data Pillar (Phase 4)
|   +-- App-level authorization (not network-level)
|   +-- Data classification and labeling
|   +-- DLP policies based on classification
|   +-- Encryption: at rest, in transit, in use where feasible
|
+-- [6] Visibility & Analytics (Continuous)
|   +-- All access decisions logged centrally
|   +-- UEBA for anomaly detection
|   +-- Continuous trust evaluation (not point-in-time)
|   +-- Automated response: revoke access on high-risk signal
|
+-- BUDGET PRIORITY (if constrained):
    1. MFA + SSO (highest ROI)
    2. Conditional access policies
    3. EDR on all endpoints
    4. ZTNA for remote access
    5. Micro-segmentation for crown jewels

2.6 Container/K8s Deployment Security

START: Container / Kubernetes Security
|
+-- [1] Image Security
|   +-- Base images: minimal (distroless/Alpine), pinned digests not tags
|   +-- No secrets in images (build args, env files, embedded creds)
|   +-- Image scanning in CI: Trivy, Grype, Snyk Container
|   +-- Signing: cosign/Notary, admission controller verifies signatures
|   +-- Registry: private, immutable tags, vulnerability auto-scanning
|
+-- [2] Build Pipeline
|   +-- Multi-stage builds (build deps not in runtime image)
|   +-- Non-root USER directive in Dockerfile
|   +-- Read-only filesystem where possible
|   +-- SBOM generation (syft) at build time
|   +-- No package managers in production images
|
+-- [3] Kubernetes Cluster Security
|   +-- API server: RBAC enabled, anonymous auth disabled, audit logging on
|   +-- etcd: encrypted at rest, mTLS, restricted network access
|   +-- Node: CIS Kubernetes Benchmark, minimal OS (Bottlerocket/Talos)
|   +-- Network: CNI with NetworkPolicy support (Calico/Cilium)
|   +-- Admission controllers:
|       +-- OPA/Gatekeeper or Kyverno
|       +-- Pod Security Standards (restricted profile)
|       +-- Block: privileged, hostNetwork, hostPID, root containers
|
+-- [4] Runtime Security
|   +-- Pod Security Context:
|   |   +-- runAsNonRoot: true
|   |   +-- readOnlyRootFilesystem: true
|   |   +-- allowPrivilegeEscalation: false
|   |   +-- drop ALL capabilities, add only needed
|   +-- Seccomp profiles (RuntimeDefault minimum)
|   +-- AppArmor/SELinux profiles for sensitive workloads
|   +-- Runtime threat detection: Falco, Tetragon, or cloud-native
|
+-- [5] Network Security
|   +-- Default-deny NetworkPolicy per namespace
|   +-- Service mesh for mTLS (Istio/Linkerd) between services
|   +-- Ingress: TLS termination, WAF integration
|   +-- Egress: explicit allow-list, no unrestricted internet access
|
+-- [6] Secrets & Config
|   +-- External secrets operator --> Vault / cloud KMS
|   +-- Never K8s Secrets without encryption at rest
|   +-- RBAC on secrets: namespace-scoped, least privilege
|   +-- Rotate secrets automatically, detect drift
|
+-- [7] Observability
    +-- Audit logs: API server --> SIEM
    +-- Container logs: structured, centralized (no kubectl logs in production)
    +-- Falco alerts --> SIEM/SOAR
    +-- Resource quotas and LimitRanges per namespace

2.7 IoT/OT Environment Segmentation

START: IoT/OT Segmentation
|
+-- [1] Asset Discovery & Classification
|   +-- Passive discovery: network TAP, SPAN port, protocol analysis
|   +-- Asset inventory: device type, firmware, protocol, criticality
|   +-- Purdue model level assignment (Level 0-5)
|   +-- Crown jewel identification: safety systems, HMIs, historians
|
+-- [2] Network Architecture (Purdue Model)
|   +-- Level 5 (Enterprise) <--DMZ--> Level 3.5 (IDMZ)
|   +-- IDMZ: data diodes or unidirectional gateways for critical flows
|   +-- Level 3 (Site Operations) <--FW--> Level 2 (Area Supervisory)
|   +-- Level 2 (HMI/SCADA) <--FW--> Level 1 (Controllers/PLCs)
|   +-- Level 0 (Physical Process) -- air-gapped where possible
|   +-- NO direct IT-to-OT connectivity bypassing IDMZ
|
+-- [3] Segmentation Controls
|   +-- Firewall between each Purdue level (not just IT/OT boundary)
|   +-- Protocol-aware firewalls for OT (Modbus, DNP3, OPC-UA inspection)
|   +-- VLAN per device class within OT (PLCs, HMIs, historians separate)
|   +-- Remote access: jump server in IDMZ, MFA, session recording
|   +-- NEVER: VPN directly to OT, flat OT network, cloud-connected PLCs
|
+-- [4] IoT Device Security
|   +-- Unique device identity (X.509 certs, not shared credentials)
|   +-- Firmware update mechanism: signed updates, rollback capability
|   +-- Disable unnecessary services (telnet, SNMP v1/v2, HTTP)
|   +-- Default credential change (automated at provisioning)
|   +-- IoT gateway pattern: devices talk to gateway, gateway talks to cloud
|
+-- [5] Monitoring & Detection
|   +-- OT-specific IDS: Claroty, Nozomi, Dragos, Microsoft Defender for IoT
|   +-- Baseline normal protocol behavior --> Alert on deviations
|   +-- Monitor: unauthorized PLC programming, firmware changes, new devices
|   +-- No active scanning in OT (can crash PLCs) --> Passive only
|
+-- [6] Incident Response (OT-Specific)
|   +-- Safety-first: never containment action that impacts safety systems
|   +-- Pre-approved response playbooks per zone
|   +-- Offline backups of PLC programs and configurations
|   +-- Manual override procedures documented and tested
|
+-- PRIORITY ORDER:
    1. Asset inventory (you cannot protect what you do not know)
    2. IT/OT boundary firewall with IDMZ
    3. Remote access hardening
    4. OT network monitoring (passive)
    5. Internal OT segmentation
    6. Device hardening (rolling, non-disruptive)

---

3. Security Tool Selection Matrix

3.1 Vulnerability Scanning

Sub-Category	Tool	License	Strengths	Weaknesses	Best For
Infrastructure	Nessus Professional	Commercial	Comprehensive plugin library, compliance checks	Expensive per-scanner licensing	Enterprise vulnerability management
	OpenVAS/Greenbone	Open Source	Free, decent coverage	Slower scan performance, UI dated	Budget-constrained teams
	Qualys VMDR	Commercial SaaS	Cloud-native, agent-based option, risk prioritization	Vendor lock-in, pricing complexity	Large distributed environments
Web Application	Burp Suite Pro	Commercial	Best manual testing proxy, extensive extensions	Learning curve, not CI-native	Pentesters, security engineers
	OWASP ZAP	Open Source	Free, CI/CD integration, active community	Higher false positives than Burp	DevSecOps pipelines, automation
	Nuclei	Open Source	Template-based, fast, community templates	Requires template knowledge	Bug bounty, rapid scanning
Container	Trivy	Open Source	Fast, multi-target (images, IaC, SBOM), CI-friendly	Less deep than commercial options	CI/CD pipeline scanning
	Grype	Open Source	Anchore-backed, SBOM integration	Smaller vulnerability DB	SBOM-centric workflows
	Snyk Container	Commercial	Developer-friendly, fix advice, IDE integration	Per-test pricing	Developer-first security
IaC	Checkov	Open Source	Multi-framework (TF, CloudFormation, K8s, Helm)	Custom policy requires effort	Broad IaC coverage
	tfsec/Trivy	Open Source	Terraform-focused, fast, CI-native	Terraform-specific (tfsec)	Terraform shops
	KICS	Open Source	Multi-framework, Checkmarx-backed	Newer, smaller community	Multi-cloud IaC scanning
Secrets	Gitleaks	Open Source	Pre-commit hooks, CI integration, regex-based	Regex limitations	Git repo scanning
	TruffleHog	Open Source	Verified secrets (actually tests validity), git history scan	Slower on large repos	Deep historical secret detection
	GitGuardian	Commercial	Real-time monitoring, remediation workflow	Pricing at scale	Enterprise secret monitoring

3.2 Detection

Sub-Category	Tool	License	Strengths	Weaknesses	Best For
SIEM	Splunk Enterprise	Commercial	Most powerful search (SPL), massive ecosystem	Expensive (data-volume pricing)	Large SOCs, complex environments
	Microsoft Sentinel	Commercial SaaS	Cloud-native, Entra integration, KQL, SOAR built-in	Azure-centric pricing, learning KQL	Microsoft/Azure shops
	Elastic Security	Open/Commercial	Open core, powerful, self-hosted option	Operational overhead self-hosted	Teams wanting open-core SIEM
	Wazuh	Open Source	Free, HIDS + SIEM, compliance, FIM	UI/UX weaker, smaller ecosystem	Budget-constrained or SMB
	CrowdStrike Falcon LogScale (Humio)	Commercial	Streaming architecture, index-free, fast	Newer SIEM entrant	High-volume log environments
EDR	CrowdStrike Falcon	Commercial	Best detection rates, lightweight agent, threat intel	Premium pricing	Enterprise endpoint protection
	Microsoft Defender for Endpoint	Commercial	Integrated with M365, good detection, included in E5	Windows-centric heritage	Microsoft E5 customers
	SentinelOne	Commercial	Autonomous response, storyline visualization	Aggressive auto-remediation can break things	Lean SOC teams
	Velociraptor	Open Source	Powerful artifact collection, VQL, forensics-grade	Not a full EDR replacement, no prevention	Threat hunting, IR, small teams
NDR	Zeek (formerly Bro)	Open Source	Best network metadata generation, scriptable	Not plug-and-play, requires expertise	Network security monitoring
	Suricata	Open Source	IDS/IPS, protocol detection, fast pattern matching	Rule tuning overhead	Network IDS/IPS
	Corelight	Commercial	Zeek-based appliance, cloud sensors, managed	Expensive	Enterprise network visibility
	Arkime (formerly Moloch)	Open Source	Full packet capture + indexing + search	Storage-heavy, operational overhead	PCAP retention and analysis
UEBA	Microsoft Sentinel UEBA	Commercial	Built into Sentinel, identity-focused	Requires Sentinel deployment	Sentinel customers
	Exabeam	Commercial	Behavioral analytics, timeline, smart timelines	Complex deployment	Large SOC, insider threat
	Securonix	Commercial	Cloud SIEM + UEBA, peer group analysis	Implementation complexity	Insider threat programs

3.3 Response

Sub-Category	Tool	License	Strengths	Weaknesses	Best For
SOAR	Palo Alto XSOAR (Demisto)	Commercial	Huge integration library, playbook builder	Complexity, licensing cost	Large SOC automation
	Tines	Commercial	No-code automation, clean UI, free community tier	Fewer native integrations than XSOAR	Growing teams, accessible automation
	Shuffle	Open Source	Free, Docker-based, OpenAPI integration	Smaller community, rougher edges	Budget SOAR, open-source teams
	Sentinel Playbooks	Commercial	Logic Apps-based, Azure-native	Azure-only, Logic Apps learning curve	Sentinel-based SOCs
IR	TheHive	Open Source	Case management, Cortex analyzers, MISP integration	Self-hosted overhead	IR teams, CERT/CSIRT
	Velociraptor	Open Source	Remote collection, VQL hunts, offline collectors	Not an IR platform per se	Artifact collection at scale
	GRR	Open Source	Google-built, remote live forensics	Dated UI, Python 2 legacy	Large-scale endpoint investigation
Forensics	Autopsy / Sleuth Kit	Open Source	Disk forensics, timeline analysis, file carving	Desktop tool, not scalable	Disk forensics
	Volatility 3	Open Source	Memory forensics standard, plugin ecosystem	Requires memory dumps, profile matching	Memory analysis
	KAPE	Free (closed)	Fast triage collection, modular targets/modules	Windows-only, not open source	Windows triage collection
	Plaso/log2timeline	Open Source	Super timeline generation, many parsers	Output can be overwhelming	Timeline creation
	Eric Zimmerman Tools	Free (closed)	Registry, shellbags, prefetch, shimcache parsers	Windows-only, individual tools	Windows artifact parsing

3.4 Offensive

Sub-Category	Tool	License	Strengths	Weaknesses	Best For
Recon	Amass	Open Source	Comprehensive subdomain enumeration, graph DB	Resource-intensive	External attack surface mapping
	Shodan	Commercial	Internet-wide scanning data, API access	Passive only, data freshness varies	Exposed service discovery
	theHarvester	Open Source	Email, subdomain, name collection from OSINT	Limited depth per source	Quick passive recon
	SpiderFoot	Open Source	Automated OSINT, 200+ modules	Can be noisy, overwhelming output	Comprehensive OSINT automation
Exploitation	Metasploit	Open Source	Standard framework, huge module library	Well-signatured by EDR/AV	Learning, initial exploitation
	Cobalt Strike	Commercial	Industry-standard red team C2, malleable C2 profiles	Expensive, widely cracked/detected	Professional red teams
	Sliver	Open Source	Modern C2, multi-protocol, implant generation	Smaller community than CS, growing detections	Budget red teams, purple teams
	Mythic	Open Source	Modular C2, multi-agent, collaborative	Setup complexity, documentation gaps	Advanced red team operations
Post-Exploitation	Impacket	Open Source	AD attack Swiss army knife, protocol implementations	Python, can be brittle	AD exploitation, lateral movement
	Rubeus	Open Source	Kerberos abuse (roasting, delegation, tickets)	.NET, detected by mature EDR	AD Kerberos attacks
	BloodHound	Open Source	AD attack path visualization, graph-based	SharpHound collection detected	AD security assessment
	Certipy	Open Source	AD CS attack tool, ESC1-ESC13	AD CS-specific	Certificate services attacks
Post-Exploitation (Linux)	LinPEAS	Open Source	Comprehensive Linux privesc enumeration	Noisy, easily detected	Linux privilege escalation
	pspy	Open Source	Process monitoring without root	Specific use case	Cron/process discovery

3.5 Compliance

Sub-Category	Tool	License	Strengths	Weaknesses	Best For
CSPM	Prowler	Open Source	AWS/Azure/GCP, CIS benchmarks, CLI-native	Multi-cloud coverage varies	Cloud security posture
	ScoutSuite	Open Source	Multi-cloud, HTML report	Less actively maintained	Quick cloud audit
	Wiz	Commercial	Graph-based, agentless, risk prioritization	Expensive	Enterprise cloud security
	Orca Security	Commercial	Agentless, SideScanning, broad coverage	Pricing at scale	Agentless cloud security
Benchmark	CIS-CAT Pro	Commercial	Official CIS benchmark scanner	Per-target licensing	CIS compliance validation
	OpenSCAP	Open Source	SCAP-based, RHEL/CentOS focus	Limited non-RHEL support	Linux compliance scanning
	Lynis	Open Source	System hardening audit, Unix/Linux	Manual remediation	Linux hardening audit
	InSpec	Open Source	Compliance as code, readable DSL	Chef ecosystem	Automated compliance testing
Audit	Drata	Commercial	Continuous compliance monitoring, SOC 2 focused	SaaS-only	Startup SOC 2/ISO compliance
	Vanta	Commercial	Automated evidence collection, framework mapping	SaaS-only, similar to Drata	Continuous compliance

---

4. Quick Reference Cards

4.1 Linux Hardening — Top 20 Commands

# 1. System updates
sudo apt update && sudo apt upgrade -y  # Debian/Ubuntu
sudo dnf update -y                       # RHEL/Fedora

# 2. Remove unnecessary packages
sudo apt autoremove --purge -y
dpkg --list | grep -i "telnet\|rsh\|nis\|tftp" | awk '{print $2}' | xargs sudo apt remove -y

# 3. Disable root SSH login
sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# 4. SSH hardening (key-only auth, restrict ciphers)
sudo cat >> /etc/ssh/sshd_config << 'SSHEOF'
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deployuser adminuser
Protocol 2
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
SSHEOF
sudo systemctl restart sshd

# 5. Configure firewall (UFW example)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 10.0.0.0/8 to any port 22
sudo ufw enable

# 6. Set password policy
sudo apt install libpam-pwquality -y
sudo sed -i 's/^# minlen.*/minlen = 14/' /etc/security/pwquality.conf
sudo sed -i 's/^# minclass.*/minclass = 3/' /etc/security/pwquality.conf

# 7. Enable audit logging
sudo apt install auditd -y
sudo systemctl enable auditd
# Key audit rules:
sudo auditctl -w /etc/passwd -p wa -k identity
sudo auditctl -w /etc/shadow -p wa -k identity
sudo auditctl -w /etc/sudoers -p wa -k sudoers_changes
sudo auditctl -a always,exit -F arch=b64 -S execve -k exec_commands

# 8. Set file permissions on critical files
sudo chmod 644 /etc/passwd
sudo chmod 000 /etc/shadow
sudo chmod 644 /etc/group
sudo chmod 000 /etc/gshadow
sudo chmod 600 /etc/ssh/sshd_config

# 9. Disable unused filesystems
echo "install cramfs /bin/true" | sudo tee /etc/modprobe.d/cramfs.conf
echo "install freevxfs /bin/true" | sudo tee /etc/modprobe.d/freevxfs.conf
echo "install udf /bin/true" | sudo tee /etc/modprobe.d/udf.conf
echo "install usb-storage /bin/true" | sudo tee /etc/modprobe.d/usb-storage.conf

# 10. Configure sysctl security parameters
sudo cat >> /etc/sysctl.d/99-security.conf << 'SYSEOF'
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
kernel.exec-shield = 1
fs.suid_dumpable = 0
SYSEOF
sudo sysctl -p /etc/sysctl.d/99-security.conf

# 11. Restrict cron access
sudo touch /etc/cron.allow
sudo chmod 600 /etc/cron.allow
echo "root" | sudo tee /etc/cron.allow
sudo rm -f /etc/cron.deny

# 12. Set UMASK
sudo sed -i 's/^UMASK.*/UMASK 027/' /etc/login.defs

# 13. Disable core dumps
echo "* hard core 0" | sudo tee -a /etc/security/limits.conf
echo "fs.suid_dumpable = 0" | sudo tee -a /etc/sysctl.conf

# 14. Find and remove SUID/SGID binaries (review output first)
find / -perm /4000 -type f 2>/dev/null  # List SUID
find / -perm /2000 -type f 2>/dev/null  # List SGID
# Remove SUID from unnecessary binaries:
sudo chmod u-s /usr/bin/newgrp  # Example

# 15. Configure fail2ban
sudo apt install fail2ban -y
sudo cat > /etc/fail2ban/jail.local << 'F2BEOF'
[sshd]
enabled = true
port = ssh
filter = sshd
maxretry = 3
bantime = 3600
findtime = 600
F2BEOF
sudo systemctl enable fail2ban && sudo systemctl start fail2ban

# 16. Enable process accounting
sudo apt install acct -y
sudo systemctl enable acct

# 17. Disable unnecessary services
for svc in avahi-daemon cups bluetooth rpcbind; do
  sudo systemctl stop "$svc" 2>/dev/null
  sudo systemctl disable "$svc" 2>/dev/null
  sudo systemctl mask "$svc" 2>/dev/null
done

# 18. Configure NTP (time sync is security-critical for log correlation)
sudo timedatectl set-ntp true
sudo apt install chrony -y
sudo systemctl enable chronyd

# 19. Set login banner (legal notice)
echo "Authorized access only. All activity is monitored and logged." | sudo tee /etc/issue.net
sudo sed -i 's/^#Banner.*/Banner \/etc\/issue.net/' /etc/ssh/sshd_config

# 20. Run Lynis audit (validate hardening)
sudo apt install lynis -y
sudo lynis audit system --quick

4.2 Windows Hardening — Top 20 GPO Settings

#	GPO Path	Setting	Value	CIS Control
1	Computer > Policies > Windows Settings > Security Settings > Account Policies > Password Policy	Minimum password length	14 characters	5.2
2	Computer > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy	Account lockout threshold	5 invalid attempts	5.2
3	Computer > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy	Account lockout duration	15 minutes	5.2
4	Computer > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy	Audit logon events	Success, Failure	8.5
5	Computer > Policies > Admin Templates > Windows Components > Windows PowerShell	Turn on Script Block Logging	Enabled	8.8
6	Computer > Policies > Admin Templates > Windows Components > Windows PowerShell	Turn on PowerShell Transcription	Enabled	8.8
7	Computer > Policies > Windows Settings > Security Settings > Advanced Audit Policy > Detailed Tracking	Audit Process Creation	Success	8.5
8	Computer > Policies > Admin Templates > System > Audit Process Creation	Include command line in process creation events	Enabled	8.5
9	Computer > Policies > Admin Templates > MS Security Guide	Configure SMBv1 client/server	Disabled	9.3
10	Computer > Policies > Windows Settings > Security Settings > Local Policies > Security Options	Network access: Restrict anonymous access to Named Pipes and Shares	Enabled	9.3
11	Computer > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment	Deny log on through Remote Desktop Services	Guests, Local account (non-admin)	5.4
12	Computer > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment	Deny access to this computer from the network	Guests, Local account	5.4
13	Computer > Policies > Admin Templates > Network > Lanman Workstation	Enable insecure guest logons	Disabled	9.3
14	Computer > Policies > Admin Templates > Windows Components > Remote Desktop Services > RD Session Host > Security	Require use of specific security layer for RDP connections	SSL/TLS	9.3
15	Computer > Policies > Admin Templates > Windows Components > Remote Desktop Services > RD Session Host > Security	Set client connection encryption level	High Level	9.3
16	Computer > Policies > Admin Templates > Windows Components > Remote Desktop Services > RD Session Host > Security	Require NLA for Remote Desktop	Enabled	9.3
17	Computer > Policies > Admin Templates > Windows Components > Windows Defender Firewall > Domain Profile	Windows Defender Firewall: Protect all network connections	Enabled	9.2
18	Computer > Policies > Admin Templates > System > Credentials Delegation	Encryption Oracle Remediation	Force Updated Clients	5.2
19	Computer > Policies > Windows Settings > Security Settings > Local Policies > Security Options	User Account Control: Run all administrators in Admin Approval Mode	Enabled	5.4
20	Computer > Policies > Admin Templates > Windows Components > Credential User Interface	Enumerate administrator accounts on elevation	Disabled	5.4

Additional critical registry settings (deploy via GPO Preferences):

Setting	Registry Path	Value
Disable WDigest cleartext creds	HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential	0
Enable LSA Protection	HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL	1
Disable LLMNR	HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast	0
Disable NetBIOS over TCP/IP	Per-adapter: HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\*\NetbiosOptions	2
Disable WPAD	HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Start	4
Enable Credential Guard	HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity	1

4.3 AWS Security — Top 20 Controls

#	Control	Service/Feature	Implementation	CIS AWS Benchmark
1	Enable CloudTrail in all regions	CloudTrail	Multi-region trail, S3 bucket with object lock, log file validation enabled	3.1
2	Enable MFA on root account	IAM	Hardware MFA token (YubiKey preferred), no root access keys	1.5, 1.6
3	No root access keys	IAM	aws iam delete-access-key --user-name root --access-key-id <key>	1.4
4	Enable GuardDuty	GuardDuty	All regions, S3 protection, EKS protection, Malware protection	4.16
5	Enable Security Hub	Security Hub	CIS AWS Foundations + AWS Foundational Security standards	—
6	S3 Block Public Access (account-level)	S3	aws s3control put-public-access-block --account-id <id> --public-access-block-configuration BlockPublic*=true	2.1.5
7	Encrypt EBS volumes by default	EC2	aws ec2 enable-ebs-encryption-by-default per region	2.2.1
8	Enable VPC Flow Logs	VPC	All VPCs, send to CloudWatch Logs or S3	3.9
9	Restrict Security Group ingress	VPC	No 0.0.0.0/0 on management ports (22, 3389), no wide-open SGs	5.2, 5.3
10	Use IAM roles, not access keys	IAM	Instance profiles for EC2, task roles for ECS, IRSA for EKS	1.16
11	Enforce MFA for IAM users	IAM	IAM policy condition: aws:MultiFactorAuthPresent	1.10
12	Enable AWS Config	Config	All regions, record all resource types	3.5
13	Enable RDS encryption	RDS	Encryption at rest enabled on creation (cannot enable after)	2.3.1
14	Rotate access keys < 90 days	IAM	Config Rule: access-keys-rotated, maxAccessKeyAge: 90	1.14
15	Use AWS Organizations + SCPs	Organizations	Deny actions: leave org, disable CloudTrail, disable GuardDuty	—
16	Enable S3 bucket logging	S3	Server access logging or CloudTrail data events for sensitive buckets	2.1.3
17	Use KMS CMK for encryption	KMS	Key rotation enabled, key policy with least privilege	2.8
18	Enable IMDSv2 (require token)	EC2	aws ec2 modify-instance-metadata-options --http-tokens required	5.6
19	Use SSM Session Manager instead of SSH	Systems Manager	No SSH keys, audit trail, no open port 22	—
20	Enable AWS Backup	Backup	Automated backups with cross-region copy, test restores quarterly	—

Quick validation commands:

# Check CloudTrail status
aws cloudtrail describe-trails --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]'

# Find public S3 buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  xargs -I{} aws s3api get-public-access-block --bucket {} 2>/dev/null

# Find security groups with 0.0.0.0/0
aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[*].[GroupId,GroupName]'

# Check for IAM users without MFA
aws iam generate-credential-report && sleep 5 && \
aws iam get-credential-report --query 'Content' --output text | \
  base64 -d | awk -F, '$4=="true" && $8=="false" {print $1" - MFA NOT ENABLED"}'

# Check IMDSv2 enforcement
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,MetadataOptions.HttpTokens]' --output table

4.4 Incident Response — First 30 Minutes

MINUTE 0-5: INITIAL TRIAGE
===========================
[ ] Who reported? How? When did they notice?
[ ] What is the suspected incident type?
    ( ) Malware/Ransomware  ( ) Phishing/BEC  ( ) Unauthorized access
    ( ) Data exfiltration   ( ) Insider threat ( ) DDoS
    ( ) Supply chain        ( ) Other: ___________
[ ] Severity assessment:
    SEV-1: Active data breach, ransomware spreading, safety risk
    SEV-2: Confirmed compromise, contained scope
    SEV-3: Suspicious activity, unconfirmed compromise
    SEV-4: Policy violation, minor security event
[ ] Activate IR team (SEV-1/2: immediate, SEV-3: business hours)
[ ] Start incident log (timestamp EVERYTHING from this point)

MINUTE 5-10: SCOPE ASSESSMENT
==============================
[ ] Identify affected systems (hostname, IP, user, service)
[ ] Determine blast radius: what can the attacker reach from here?
[ ] Check: is the attack still active? (ongoing exfil, lateral movement)
[ ] Review relevant alerts in SIEM (last 24-72 hours for affected systems)
[ ] Check EDR console for affected endpoints
[ ] Document IOCs observed so far:
    - IPs/Domains: ___________
    - File hashes: ___________
    - User accounts: ___________
    - Process names: ___________

MINUTE 10-15: EVIDENCE PRESERVATION
=====================================
[ ] DO NOT reboot affected systems (destroys memory evidence)
[ ] DO NOT run AV scans yet (overwrites artifacts)
[ ] Capture volatile evidence FIRST:
    - Memory dump (WinPmem, LiME, or Velociraptor memory artifact)
    - Running processes, network connections, logged-in users
    - Clipboard contents, command history
[ ] Disk image (if feasible) or triage collection (KAPE, Velociraptor)
[ ] Preserve relevant logs:
    - Security/System event logs
    - PowerShell/WMI logs
    - Web server logs
    - Authentication logs
    - Firewall/proxy logs
[ ] Screenshot any visible attacker activity

MINUTE 15-20: CONTAINMENT DECISION
====================================
[ ] Containment strategy (choose based on situation):
    NETWORK:
    [ ] Isolate host from network (EDR network isolation preferred)
    [ ] Block IOC IPs/domains at firewall/proxy
    [ ] Disable compromised VPN/remote access accounts
    IDENTITY:
    [ ] Reset compromised credentials (user + service accounts)
    [ ] Revoke active sessions/tokens
    [ ] Disable compromised accounts (if business allows)
    ENDPOINT:
    [ ] EDR isolation (maintains remote investigation access)
    [ ] Disable network adapter (last resort, loses remote access)
    NOTE: Do NOT wipe systems until evidence is preserved

MINUTE 20-25: INITIAL INVESTIGATION
=====================================
[ ] Timeline: what was the first malicious activity? (patient zero)
[ ] Entry vector: how did attacker get in?
    - Email (check email gateway logs)
    - Exploit (check WAF/IDS, vulnerability scan data)
    - Credentials (check auth logs, dark web exposure)
    - Supply chain (check recent software updates)
[ ] Lateral movement: did attacker move to other systems?
    - Check 4624 Type 3/10 from compromised host
    - Check for psexec/wmi/winrm activity
    - Check admin share access (5140/5145)
[ ] Persistence: did attacker establish persistence?
    - Scheduled tasks, services, registry run keys
    - New user accounts, modified groups
    - Web shells, backdoors

MINUTE 25-30: COMMUNICATION & ESCALATION
==========================================
[ ] Update incident log with all findings
[ ] Notify stakeholders per IR plan:
    SEV-1: CISO, Legal, Comms, Executive leadership
    SEV-2: CISO, IT management, affected business units
    SEV-3: Security management
[ ] Legal hold notice if data breach suspected
[ ] Regulatory notification clock check:
    - GDPR: 72 hours from awareness (Art. 33)
    - HIPAA: 60 days
    - SEC: 4 business days (material incidents)
    - State breach laws: varies (check applicable)
[ ] Document: what do we know, what don't we know, what are we doing next
[ ] Set next check-in time (SEV-1: every 1hr, SEV-2: every 4hr)

POST-30 MINUTES: ONGOING
=========================
[ ] Continue evidence collection and analysis
[ ] Expand containment as scope clarifies
[ ] Begin eradication planning (do NOT eradicate before full scope known)
[ ] Prepare external notification (customers, regulators) if needed
[ ] Engage external IR firm if scope exceeds internal capability

4.5 Threat Hunting — Daily Checklist

DAILY THREAT HUNTING CHECKLIST
===============================
Time: ___  Analyst: ___  Date: ___

AUTHENTICATION ANOMALIES (15 min)
----------------------------------
[ ] Failed login spikes (>10 failures in 5min per account)
    KQL: SigninLogs | where ResultType != 0 | summarize count() by UserPrincipalName, bin(TimeGenerated, 5m) | where count_ > 10
    SPL: index=auth action=failure | stats count by user _time span=5m | where count>10

[ ] Logins from new locations/IPs for privileged accounts
    KQL: SigninLogs | where UserPrincipalName in (privileged_users) | where Location !in (known_locations)

[ ] Impossible travel (same user, different geo, <impossible time)
    KQL: SigninLogs | where RiskEventTypes has "impossibleTravel"

[ ] Off-hours authentication (define business hours per region)
    SPL: index=auth action=success date_hour<6 OR date_hour>22 | stats count by user, src_ip

[ ] Service account interactive logons (should be non-interactive only)
    KQL: SecurityEvent | where EventID == 4624 and LogonType in (2,10) and TargetUserName matches regex @"^svc_"

PROCESS & EXECUTION ANOMALIES (15 min)
----------------------------------------
[ ] LOLBin execution from unusual parents
    Look for: certutil, mshta, regsvr32, rundll32, msbuild
    KQL: DeviceProcessEvents | where FileName in ("certutil.exe","mshta.exe","regsvr32.exe") and InitiatingProcessFileName !in ("explorer.exe","cmd.exe")

[ ] Encoded PowerShell commands
    KQL: DeviceProcessEvents | where FileName == "powershell.exe" and ProcessCommandLine has_any("-enc","-e ","-encodedcommand")

[ ] Processes spawned by Office applications
    KQL: DeviceProcessEvents | where InitiatingProcessFileName in ("winword.exe","excel.exe","outlook.exe") and FileName in ("cmd.exe","powershell.exe","wscript.exe","mshta.exe")

[ ] Scheduled task creation (especially by non-admin)
    KQL: SecurityEvent | where EventID == 4698

[ ] New services installed
    KQL: SecurityEvent | where EventID == 7045

NETWORK ANOMALIES (15 min)
---------------------------
[ ] DNS query volume spikes per host
    KQL: DnsEvents | summarize QueryCount=count() by ClientIP, bin(TimeGenerated, 1h) | where QueryCount > 1000

[ ] Long DNS queries (>50 chars) — potential DNS tunneling
    KQL: DnsEvents | where strlen(Name) > 50

[ ] Connections to newly registered domains (<30 days old)
    Check against threat intel feed or WHOIS data

[ ] Beaconing detection (regular interval connections)
    SPL: index=proxy | stats count, stdev(eval(relative_time(_time, "@h"))) as jitter by dest_domain, src_ip | where count>50 AND jitter<60

[ ] Large outbound transfers (>100MB to single destination)
    KQL: DeviceNetworkEvents | summarize TotalBytes=sum(SentBytes) by DeviceName, RemoteIP | where TotalBytes > 104857600

[ ] Connections to known-bad TOR exit nodes
    Cross-reference with TOR exit node list

PERSISTENCE CHECKS (10 min)
-----------------------------
[ ] New registry run key entries (last 24h)
    KQL: DeviceRegistryEvents | where RegistryKey has_any("\\Run","\\RunOnce") and ActionType == "RegistryValueSet" and Timestamp > ago(24h)

[ ] New startup folder items
    KQL: DeviceFileEvents | where FolderPath has "\\Start Menu\\Programs\\Startup" and Timestamp > ago(24h)

[ ] WMI event subscriptions created
    KQL: DeviceEvents | where ActionType == "WmiBindingEvent" and Timestamp > ago(24h)

[ ] New user accounts created
    KQL: SecurityEvent | where EventID == 4720 and TimeGenerated > ago(24h)

[ ] Changes to Group Policy
    KQL: SecurityEvent | where EventID in (4739, 5136, 5137) and TimeGenerated > ago(24h)

CREDENTIAL ACCESS (5 min)
--------------------------
[ ] LSASS access from unusual processes
    KQL: DeviceProcessEvents | where ActionType == "OpenProcess" and FileName == "lsass.exe" and InitiatingProcessFileName !in ("svchost.exe","csrss.exe","wininit.exe","lsaiso.exe")

[ ] Kerberoasting indicators (RC4 TGS requests)
    KQL: SecurityEvent | where EventID == 4769 and TicketEncryptionType == "0x17" and ServiceName !endswith "$"

[ ] Password spray patterns (many users, few attempts each)
    KQL: SecurityEvent | where EventID == 4625 | summarize UserCount=dcount(TargetUserName) by IpAddress, bin(TimeGenerated, 10m) | where UserCount > 10

CLOUD-SPECIFIC (if applicable, 10 min)
----------------------------------------
[ ] Console logins without MFA
    KQL: AuditLogs | where OperationName == "User login" and AuthenticationRequirement != "multiFactorAuthentication"

[ ] IAM policy changes / new access keys created
    AWS: CloudTrail events: CreateAccessKey, PutUserPolicy, AttachUserPolicy, CreateRole
    KQL: AWSCloudTrail | where EventName in ("CreateAccessKey","AttachUserPolicy","CreateRole")

[ ] S3/Blob/GCS public access changes
    AWS: CloudTrail event: PutBucketPolicy, PutBucketAcl
    KQL: AWSCloudTrail | where EventName in ("PutBucketPolicy","PutBucketAcl","PutPublicAccessBlock")

[ ] Unusual API calls from new IPs
    KQL: AWSCloudTrail | summarize FirstSeen=min(TimeGenerated) by SourceIpAddress | where FirstSeen > ago(24h)

DOCUMENTATION (5 min)
----------------------
[ ] Log any findings in hunting journal
[ ] Update detection rules if new patterns found
[ ] Submit IOCs to threat intel platform
[ ] Report any confirmed findings to SOC for triage
[ ] Note hypotheses for tomorrow's hunt

Total estimated time: ~60-70 minutes
Recommended cadence: Daily (weekdays), abbreviated on weekends

---

Appendix: Log Source Priority Matrix

When building a detection program from scratch, enable log sources in this order for maximum coverage per effort:

Priority	Log Source	Techniques Covered	Effort
1	Windows Security Log (with command-line auditing)	35+ of top 50	Low
2	Sysmon (SwiftOnSecurity config)	40+ of top 50	Low
3	PowerShell Script Block Logging (4104)	All PowerShell-based TTPs	Low
4	Firewall/proxy logs	Network-based TTPs, exfiltration, C2	Medium
5	DNS query logging	DNS tunneling, DGA, C2	Low
6	Cloud audit logs (CloudTrail, Entra, etc.)	Cloud-specific TTPs	Low
7	Email gateway logs	Initial access (phishing)	Medium
8	EDR telemetry	Process injection, in-memory attacks	Medium
9	IDS/IPS (Suricata, Snort)	Network exploitation, known signatures	Medium
10	DLP/CASB	Exfiltration, data access anomalies	High

---

End of synthesis document. Keep this reference alongside MITRE ATT&CK Navigator and your SIEM query library for operational use.