> For the complete documentation index, see [llms.txt](https://rootguard.gitbook.io/cyberops/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rootguard.gitbook.io/cyberops/welcome/rootguard.md). # RootGuard #### Operational Defence & Incident Response Procedures **Practical. Field-Tested. Enterprise-Ready.** RootGuard serves as a comprehensive field manual for SOC analysts, detection engineers, and incident responders operating in high-threat environments. Moving beyond theoretical certification checklists, this repository focuses on immediate operational utility for active defence scenarios. We provide high-density, deployment-ready resources: precision KQL queries, forensic artifact breakdowns, and structured playbooks designed to detect, contain, and eradicate sophisticated threats. #### Core Objectives * **Identity Security:** Mitigation strategies for Active Directory and Entra ID vectors. * **Digital Forensics & IR:** Methodologies for surgical breach reconstruction. * **Detection Engineering:** Development of high-fidelity alerting logic. *** ### Technical Modules #### 🛡️ Detection Engineering & KQL High-signal logic for detecting evasion techniques. * **Identity Forgery:** Golden/Silver Ticket analysis. * **Credential Attacks:** Kerberoasting, AS-REP Roasting, and DCSync detection. * **Lateral Movement:** Pass-the-Ticket and Overpass-the-Hash validation. * **Cloud Security:** Entra ID compromise and privilege escalation monitoring. * ***Scope:** Deployable queries optimised for Microsoft Sentinel & Defender.* #### 🔬 Windows Forensics & DFIR Deep-dive artifact analysis for evidence verification. * **Execution Evidence:** Registry analysis (ShimCache, AmCache, UserAssist). * **Timeline Reconstruction:** Event Logs, Prefetch, SRUM, and BAM data. * **Attack Patterns:** Correlating persistence mechanisms and lateral movement. * ***Output:** Structured timelines and correlation playbooks.* #### 🩸 Incident Response Playbooks Lifecycle management from detection to recovery. * **Triage:** Rapid assessment protocols. * **Containment:** Privilege escalation isolation. * **Recovery:** Ransomware response procedures. * **Data Protection:** Exfiltration detection and blocking at the wire. #### ⚔️ Offensive Security for Defenders Adversary tradecraft analysis for proactive hardening. * **Access Vectors:** Credential stuffing, spraying, and brute-force patterns. * **Lateral Movement:** Analysis of PsExec, WMI, and WinRM traffic. * **Exploitation:** Post-exploitation techniques and "living-off-the-land" binaries. #### 🕸️ Malware & Network Forensics Artifact dissection and traffic analysis. * Static and dynamic malware analysis workflows. * PCAP investigation using Wireshark and TShark. * IOC extraction and behavioural hunting rule generation. *** ### The RootGuard Standard
FeatureOperational Value
Actionable UtilityPrioritises exact commands, queries, log samples, and execution steps over theory.
Platform AgnosticCore principles apply universally, supported by deep integration with the Microsoft ecosystem.
Living IntelligenceContinuously updated based on emerging threats and operational feedback.
Defender CentricDerived from active incident response engagements and real-world breach data.
*** ### Access the Arsenal * [Detection Engineering](https://rootguard.gitbook.io/cyberops/detection-engineering/attack-triage-playbooks-kql-triage): AD Attacks & KQL Triage * [Defensive Security](https://rootguard.gitbook.io/cyberops/detection-engineering/ad-detections-and-mitigations): Windows Forensics & IR Strategies * [Offensive Security](https://rootguard.gitbook.io/cyberops/offensive-security/exploitation-and-lateral-movement): Exploitation & Password Attacks * [Learning Hub](https://rootguard.gitbook.io/cyberops): Core Skills & Career Development * [About the Author](https://www.google.com/search?q=https://rootguard.gitbook.io/cyberops/about-the-author): Operational Background *** **RootGuard:** Elevating the defensive baseline. ***Authorised for defensive operations only. Ensure compliance with all applicable legal frameworks and ethical standards.***