Upstream Intel & Gold-Standard Sources
In enterprise detection engineering, threat hunting, and digital forensics, relying on verified, high-fidelity upstream repositories separates amateur alerts from tier-1 tactical operations.
Below is the verified gold-standard registry of upstream repositories, research feeds, and search engines utilized across MIMIR.
🏛️ 1. Official Microsoft Security Repositories
Section titled “🏛️ 1. Official Microsoft Security Repositories”The primary source of truth for KQL hunting queries, analytics rules, and XDR table schemas.
| Repository / Resource | Maintainer | Focus Area | Direct Link |
|---|---|---|---|
| M365 Defender Hunting Queries | Microsoft Threat Intelligence (MSTIC) | Advanced hunting queries for Defender for Endpoint, Office, and Cloud Apps | GitHub microsoft/Microsoft-365-Defender-Hunting-Queries |
| Azure Sentinel Master Repo | Microsoft Sentinel Community & Product Team | Production analytics rules, hunting queries, workbooks, and SOAR playbooks | GitHub Azure/Azure-Sentinel |
| Microsoft Defender XDR Schema | Microsoft Learn Docs | Schema definitions for DeviceProcessEvents, DeviceNetworkEvents, etc. | Defender XDR Schema Reference |
| Microsoft Security Response Center (MSRC) | MSRC Engineering | 0-day disclosures, CVE analysis, and out-of-band vulnerability advisories | MSRC Blog & Advisories |
🛡️ 2. Universal Detection Engineering & Attack Baselines
Section titled “🛡️ 2. Universal Detection Engineering & Attack Baselines”The vendor-agnostic benchmarks for adversary techniques and detection signatures.
SigmaHQ (The Universal Detection Format)
Section titled “SigmaHQ (The Universal Detection Format)”- Repo: GitHub
SigmaHQ/sigma - Why it’s the Gold Standard: Maintained by Florian Roth and the open-source detection engineering community. Sigma rules define detection logic in standard YAML, which compiles directly into native KQL, Splunk SPL, or Elastic Lucene using
pySigma-backend-kusto. - Compiling to KQL:
Terminal window sigma convert -t kusto -p mde_process_creation rule.yml
The MITRE ATT&CK® Matrix
Section titled “The MITRE ATT&CK® Matrix”- Resource: attack.mitre.org
- Cyber Analytics Repository (CAR): car.mitre.org
- Why it’s essential: Every query in Mimir maps to a specific ATT&CK ID (e.g.,
T1003.001for LSASS dumping,T1059.001for PowerShell execution).
The LOLBAS Project (Living Off The Land Binaries)
Section titled “The LOLBAS Project (Living Off The Land Binaries)”- Repo / Web: lolbas-project.github.io
- Focus: Exhaustive catalog of every Microsoft-signed native executable (
certutil,bitsadmin,mshta,regsvr32) that can be abused for payload downloads, proxy execution, or credential dumping.
🔬 3. SANS DFIR & Eric Zimmerman Forensic Toolchain
Section titled “🔬 3. SANS DFIR & Eric Zimmerman Forensic Toolchain”For disk, file system, memory, and Windows artifact parsing.
| Tool | Author | Forensic Purpose | Repository / Download |
|---|---|---|---|
| Zimmerman Tools Suite | Eric Zimmerman (ex-FBI / SANS) | Master suite: MFTECmd, PECmd, AppCompatCacheParser, SrumECmd, LECmd | Eric Zimmerman’s Tools (GitHub) |
| SANS DFIR Posters & Cheat Sheets | SANS Institute | Windows Artifact Analysis poster (FOR500) & Memory Forensics poster (FOR508) | SANS DFIR Resources |
| Volatility 3 | The Volatility Foundation | Memory extraction framework for .raw, .vmem, .dmp RAM images | Volatility 3 GitHub |
| Velociraptor | Rapid7 / Mike Cohen | Advanced endpoint visibility, live response, and artifact collection framework | Velociraptor GitHub |
👑 4. Curated Community KQL Databases
Section titled “👑 4. Curated Community KQL Databases”Dedicated community repositories indexing thousands of verified KQL hunting queries:
- Bert-Jan Cyber (
Bert-JanP):- Master repository: Bert-JanP/Hunting-Queries-Detection-Rules
- Widely considered one of the highest-quality, well-tested collections of Sentinel and Defender XDR hunting rules anywhere.
- KQLSearch.com:
- Web: kqlsearch.com
- Searchable index across thousands of Microsoft Sentinel and Defender hunting rules.
- KQLQuery.com:
- Web: kqlquery.com
- Community-maintained KQL reference with interactive syntax examples and operator breakdowns.
- SpecterOps Research:
- Web: posts.specterops.io
- The authority on Entra ID and cloud identity attack paths, BloodHound Enterprise graph analysis, and Tier-0 cloud compromise mechanics.
🔄 How Queries are Validated in Mimir
Section titled “🔄 How Queries are Validated in Mimir”Every hunting rule and script embedded in Mimir adheres to this triage pipeline:
[Threat / CVE / Alert] │ ▼[MITRE ATT&CK Technique Mapping] (e.g. T1003.001) │ ▼[Upstream Query Source] (MSTIC / SigmaHQ / Bert-Jan / Zimmerman) │ ▼[Schema & Performance Tuning] (Cardinality filtering, Timestamp binning, mv-expand) │ ▼[MIMIR Tactical Playbook Ready]