UMBRASEC is an independent defensive security practice in Australia. I publish detection engineering, threat analysis, and a free SMB security guide - and I take on scoped advisory work when a business wants the same method run with them.
This is where writeups land - technical, sourced, and reproducible against your own data. No filler and no recycled vendor posts; the list grows as new analysis ships.
Every technical claim links back to primary sources - vendor advisories, MITRE ATT&CK, CVE records, and reputable reporting. If it isn't cited, it isn't stated.
The work explains how attacks function so defenders can catch them - detection logic, log artifacts, mitigations. No weaponized exploits, jailbreak libraries, or malware ship from here.
Detections come as rules you can run, mapped to real event IDs and ATT&CK techniques, with false-positive and tuning notes - so you can verify them against your own environment.
On honesty: You won't find report counts, disclosure tallies, or marketing metrics on this site. The work is the argument - every rule runnable, every claim tied to a primary source, all of it there to be checked.
Small defensive artefacts from the writeups - rules, a KEV monitor, a blue-team reference. They are evidence of how the work is done, not a product line. Status labels are honest.
A zero-dependency Python monitor for the CISA Known Exploited Vulnerabilities (KEV) catalog. Tracks newly added, actively-exploited CVEs and flags ones that match products you care about. Public data only.
View on Codeberg →The Sigma rules and KQL queries from the research writeups, shipped as runnable files - seven Sigma rules (Kerberoasting, LiteLLM command injection, N-central post-exploitation) and three OAuth consent-phishing KQL queries so far, each mapped to its ATT&CK technique. Grows one writeup at a time.
View on Codeberg →A comprehensive, single-page defender reference - the full defensive lifecycle mapped end to end: SIEM and log-source priority, detection engineering, incident-response flow chains, threat hunting, identity and cloud hardening, SOAR playbooks, and LLM-app defense. ATT&CK-aligned, built for analysts who need actionable depth.
Open the mapper →Corrections, source suggestions, or a detection that didn't behave the way the writeup said it would? That's exactly the feedback this project wants. Open an issue on Codeberg or send an email.
Everything here is free to read - no paywall, no email gate.