UMBRASEC is a new, independent research project focused on the defensive side of security - detection engineering, honest threat analysis, and open-source tooling that helps defenders spot real techniques in their own logs.
This is where writeups land. Three published so far - the honest starting point for a project that's only days old. Each piece is technical, sourced, and reproducible against your own data.
Every technical claim links back to primary sources - vendor advisories, MITRE ATT&CK, CVE records, and reputable reporting. If it isn't cited, it isn't stated.
The work explains how attacks function so defenders can catch them - detection logic, log artifacts, mitigations. No weaponized exploits, jailbreak libraries, or malware ship from here.
Detections come as rules you can run, mapped to real event IDs and ATT&CK techniques, with false-positive and tuning notes - so you can verify them against your own environment.
On honesty: UMBRASEC is brand new. You won't find report counts, disclosure tallies, or claims of a long history on this site, because there isn't one yet. The reputation, if it comes, will come from work you can read and check.
Small, useful, open-source tools for defenders - built in the open on GitHub. Honest status labels; nothing here claims to be more finished than it is.
A zero-dependency Python monitor for the CISA Known Exploited Vulnerabilities (KEV) catalog. Tracks newly added, actively-exploited CVEs and flags ones that match products you care about. Public data only.
View on GitHub →The Sigma rules and KQL queries from the research writeups, shipped as runnable files - three Kerberoasting detections and three OAuth consent-phishing queries so far. Grows one writeup at a time.
View on GitHub →A comprehensive, single-page defender reference - the full defensive lifecycle mapped end to end: SIEM and log-source priority, detection engineering, incident-response flow chains, threat hunting, identity and cloud hardening, SOAR playbooks, and LLM-app defense. ATT&CK-aligned, built for analysts who need actionable depth.
Open the mapper →Corrections, source suggestions, or a detection that didn't behave the way the writeup said it would? That's exactly the feedback this project wants. Open an issue on GitHub or send an email.
Everything here is free to read - no paywall, no email gate. Optional crypto tips live in the footer.