Cheat Sheets
Fast, plain-text references for defenders — detection, forensics, hardening, compliance and the day-to-day commands you keep forgetting.
118 sheets. Each opens as its own page you can read, search or print — no login, no tracking. Offensive / red-team sheets live on OffensiveRamen.com.
118 sheets
Detection & SIEM 22
- CYBERCHEF RECIPES CYBERCHEF-RECIPES
- MICROSOFT 365 DEFENDER KQL DEFENDER-KQL
- DETECTION ENGINEERING DETECTION-ENGINEERING
- ELASTIC/ELK STACK ELASTIC-ELK
- FALCO FALCO
- IOC ENRICHMENT IOC-ENRICHMENT
- LATERAL MOVEMENT DETECTION LATERAL-MOVEMENT-DETECTION
- LOKI & THOR LITE IOC SCANNER LOKI-THOR
- MITRE ATT&CK MITRE-ATTACK
- POWERSHELL LOGGING POWERSHELL-LOGGING
- QRADAR AQL QRADAR-AQL
- MICROSOFT SENTINEL KQL SENTINEL-KQL
- SIGMA RULES SIGMA
- SOAR SOAR
- SPLUNK SPLUNK
- SYSMON SYSMON
- CYBER THREAT INTELLIGENCE THREAT-INTELLIGENCE
- WINDOWS AUDIT POLICY AND EVENT LOG SETTINGS WINDOWS-AUDIT-POLICY
- WINDOWS LOGON TYPES WINDOWS-LOGON-TYPES
- WINDOWS SECURITY EVENT IDS WINDOWS-SECURITY-EVENT-IDS
- WINLOGBEAT WINLOGBEAT
- YARA YARA
DFIR & triage 24
- ACCOUNT COMPROMISE TRIAGE ACCOUNT-COMPROMISE-TRIAGE
- AUTOPSY AUTOPSY
- CHAINSAW CHAINSAW
- CYBER TRIAGE CYBER-TRIAGE
- EMAIL & BEC TRIAGE EMAIL-BEC-TRIAGE
- EMAIL HEADER ANALYSIS EMAIL-HEADER-ANALYSIS
- ERIC ZIMMERMAN TOOLS (EZTOOLS) EZTOOLS
- INCIDENT RESPONSE INCIDENT-RESPONSE
- KAPE KAPE
- KUBERNETES & CONTAINER INCIDENT RESPONSE KUBERNETES-CONTAINER-IR
- LINUX FORENSICS COMMANDS LINUX-FORENSICS
- LINUX PERSISTENCE DETECTION LINUX-PERSISTENCE-DETECTION
- MACOS FORENSICS MACOS-FORENSICS
- MEMORY FORENSICS WITH VOLATILITY 3 MEMORY-FORENSICS
- MOBILE FORENSICS MOBILE-FORENSICS
- PLASO / LOG2TIMELINE PLASO
- POWERSHELL FOR BLUE TEAM POWERSHELL-BLUETEAM
- RANSOMWARE TRIAGE RANSOMWARE-TRIAGE
- TIMESKETCH TIMESKETCH
- VELOCIRAPTOR VELOCIRAPTOR
- VOLATILITY VOLATILITY
- WEB SERVER LOG TRIAGE WEB-SERVER-LOG-TRIAGE
- WINDOWS LIVE RESPONSE (BUILT-IN TOOLS) WINDOWS-LIVE-RESPONSE
- WINDOWS PERSISTENCE LOCATIONS WINDOWS-PERSISTENCE-LOCATIONS
Network 11
Cloud & containers 11
- AWS DETECTION (CLOUDTRAIL) AWS-DETECTION
- AZURE RESOURCE INCIDENT RESPONSE AZURE-RESOURCE-IR
- CHECKOV CHECKOV
- CLOUDTRAIL & AZURE MONITOR LOG ANALYSIS FOR SOC CLOUD-LOG-ANALYSIS
- CONTAINER SECURITY (DOCKER & KUBERNETES) CONTAINER-SECURITY
- DOCKER DOCKER
- DOCKER SECURITY HARDENING DockerSecurity
- ENTRA ID AND GCP DETECTION ENTRA-GCP-DETECTION
- GRYPE GRYPE
- KUBERNETES SECURITY KUBERNETES-SECURITY
- TRIVY TRIVY
Hardening & crypto 21
- ACTIVE DIRECTORY DEFENSE AD-DEFENSE
- JINJA2 & ANSIBLE FOR HARDENING ANSIBLE-HARDENING
- ATTRIB ATTRIB
- AUDITD AUDITD
- CHMOD & CHOWN CHMOD
- DEFENDER ASR RULES AND APP CONTROL DEFENDER-ASR-APP-CONTROL
- FAIL2BAN & UFW Fail2ban
- GIT SECURITY & SECRETS HYGIENE GIT-SECURITY
- GPG GPG
- GPG & AGE ENCRYPTION GPG-AGE
- ICACLS ICACLS
- ICS / OT SECURITY ICS-OT-SECURITY
- LINUX FIREWALL AUDIT (NFTABLES AND IPTABLES) LINUX-FIREWALL-AUDIT
- OPENSSL: TLS AND CERTIFICATE CHECKS OPENSSL-TLS-CHECKS
- OSQUERY OSQUERY
- POSTGRESQL HARDENING POSTGRESQL-HARDENING
- REDIS HARDENING REDIS-HARDENING
- SSH SSH
- SYSTEMD SERVICE HARDENING SYSTEMD-SERVICE-HARDENING
- USB DEVICE CONTROL USB-DEVICE-CONTROL
- WEB SERVER HARDENING (APACHE AND NGINX) WEB-SERVER-HARDENING
Compliance 8
Command line & dev 20
- AWK COMMAND AWK
- BASH SCRIPTING BashScripting
- CMD CMD
- CRONTAB CRONTAB
- CUT COMMAND CUT
- DD COMMAND DD
- FIND COMMAND FIND
- GDB DEBUGGER GDB
- GREP GREP
- HTML5 HTML5
- JOURNALCTL JOURNALCTL
- JQ JQ
- LINUX ONE-LINERS LinuxOneLiners
- LSOF LSOF
- MAC KEYBOARD SHORTCUTS FOR CODING MAC-KEYBOARD
- POWERSHELL POWERSHELL
- RSYSLOG RSYSLOG
- TAR COMMAND TAR
- TMUX TMUX
- VIM VIM
Reference 1
No cheat sheet matches that. Try a shorter word.