INDEPENDENT RESEARCH • EST. 2026

Attackers improve.
Defenders should too.

UMBRASEC is a new, independent research project focused on the defensive side of security - detection engineering, honest threat analysis, and open-source tooling that helps defenders spot real techniques in their own logs.

NEW & BUILDING IN THE OPEN
An independent, one-person research project.
Started 2026. No company, no clients, no track record to inflate - just published work you can check.
SCOPE
Defensive research only - detection, analysis, and mitigation. No offensive tooling, exploits, or malware published here.

How this project works.

Sourced, not asserted

Every technical claim links back to primary sources - vendor advisories, MITRE ATT&CK, CVE records, and reputable reporting. If it isn't cited, it isn't stated.

Defensive by scope

The work explains how attacks function so defenders can catch them - detection logic, log artifacts, mitigations. No weaponized exploits, jailbreak libraries, or malware ship from here.

Reproducible

Detections come as rules you can run, mapped to real event IDs and ATT&CK techniques, with false-positive and tuning notes - so you can verify them against your own environment.

On honesty: UMBRASEC is brand new. You won't find report counts, disclosure tallies, or claims of a long history on this site, because there isn't one yet. The reputation, if it comes, will come from work you can read and check.

Defensive tooling.

Small, useful, open-source tools for defenders - built in the open on GitHub. Honest status labels; nothing here claims to be more finished than it is.

kev-watch
WORKING

A zero-dependency Python monitor for the CISA Known Exploited Vulnerabilities (KEV) catalog. Tracks newly added, actively-exploited CVEs and flags ones that match products you care about. Public data only.

View on GitHub →
sigma-pack
EARLY

The Sigma rules and KQL queries from the research writeups, shipped as runnable files - three Kerberoasting detections and three OAuth consent-phishing queries so far. Grows one writeup at a time.

View on GitHub →
Blue Team Mapper
LIVE

A comprehensive, single-page defender reference - the full defensive lifecycle mapped end to end: SIEM and log-source priority, detection engineering, incident-response flow chains, threat hunting, identity and cloud hardening, SOAR playbooks, and LLM-app defense. ATT&CK-aligned, built for analysts who need actionable depth.

Open the mapper →

Get in touch.

Corrections, source suggestions, or a detection that didn't behave the way the writeup said it would? That's exactly the feedback this project wants. Open an issue on GitHub or send an email.

Everything here is free to read - no paywall, no email gate. Optional crypto tips live in the footer.