$ show OTRF/ThreatHunter-Playbook
This repository is a community-driven threat hunting and detection engineering knowledge base rather than a deployable application. It contains 26+ Windows-focused Jupyter notebooks (authored as Jupytext Markdown) that each follow a strict hypothesis-driven methodology: hypothesis, technical context, offensive tradecraft, pre-recorded security datasets, SQL/Pandas analytics, and Sigma rule output. The repo also includes deep Windows internals documentation, MITRE ATT&CK group profiles (CTI), pre-hunt data management guidance, and a small YARA signature set. The dominant character is data_research: the core artifacts are analytical notebooks, structured metadata, and threat intelligence data, with a hybrid component of Python build scripts that generate the Jupyter Book, table of contents, ATT&CK Navigator layers, and evaluation reports.
The LLM identified 5 files worth highlighting for reuse:
Builds a Jupyter Book structure from hunt metadata YAML files, generating the TOC, ATT&CK Navigator JSON layers, summary tables, and platform intro pages. This is a reusable pattern for any metadata-driven documentation or knowledge-base generation pipeline.
Generates APT29 detection evaluation notebooks and markdown reports from YAML step definitions, including Spark SQL queries and Bokeh visualizations. Demonstrates a clean, repeatable pattern for turning structured evaluation steps into reproducible analytical reports.
Generates static MITRE ATT&CK group profile pages (resources/cti/G*.md) from framework data using a Jinja2 template. This is a reusable utility for keeping structured threat-intel documentation in sync with an upstream framework.
A canonical threat hunting notebook demonstrating a complete hypothesis-to-detection workflow. It pairs SQL and Pandas queries, correlates Sysmon and Windows security events, and links results to Sigma rules. The structure is highly reusable as a template for authoring new detection research notebooks.
A standalone YARA signature targeting process herpaderping, a defense evasion technique. It demonstrates non-obvious detection engineering and can be extracted directly into any YARA-based scanning pipeline.