Defensive
dotgibson
One authored-once core, eight operating systems, two role layers.
- Zsh
- Neovim
- tmux
- Python
- Bash
- Docker
- repositories
- 13
- operating systems
- 8
- Python & Bash scripts
- ~370
- paired detection entries
- 20+
The core — zsh, tmux, Neovim, git, starship, mise — is authored once and vendored into every per-OS repository with git subtree, so a tagged clone carries the exact core it was tested against. Eight platforms: macOS, Windows/WSL2, Kali, Arch, Fedora, openSUSE, Gentoo, and Alpine.
Two role layers sit on top. The offensive layer maps engagement phase to ATT&CK tactic to tooling, and enforces a rule-zero worth stating: the engagement bootstrap writes a scope file before anything else runs. Installing a tool is not permission to point it at anything.
The defensive layer is detection engineering plus a Dockerized hunt lab, with Python fixture generators that synthesize the traffic a detection is supposed to catch — DNS tunneling, DGA beaconing, ICMP tunneling, authentication coercion, cryptomining, reverse tunnels — so rules are validated against generated evidence rather than hope.
htpx ties the halves together: an ATT&CK-tagged corpus pairing each offensive technique with its detection, roughly 20 blue-side entries covering DCSync, Kerberoasting, golden tickets, ADCS abuse, and NTLM relay. The purple-team guidance is one line: detect on the invariant, not the IOC.
Details
- Authored-once core vendored via git subtree into eight per-OS repositories
- Offensive layer maps engagement phase → ATT&CK tactic → tooling, with scope written before any tool runs
- Defensive layer ships a Dockerized hunt lab and Sigma rule evaluation
- Python fixture generators for DNS tunneling, DGA, ICMP tunneling, coercion, cryptomining, and reverse tunnels
- htpx: ATT&CK-tagged corpus pairing each technique with its detection
- Typed YAML frontmatter throughout, browsable from the terminal via fzf