Defensive Tools

hardenedvault/ved-ebpf

eBPF-based runtime kernel security monitor detecting exploits and rootkits via control flow integrity (wCFI) and privilege escalation detection (PSD)…

zephrfish/stompy

Timestomp Tool to flatten MAC times with a specific timestamp

spyboy-productions/facad1ng

Open-source URL masking & analysis tool for security research, phishing awareness, and defensive testing. Demonstrates adversary techniques used to…

tomiwa-ot/py-amsi

Scan strings or files for malware using the Windows Antimalware Scan Interface

halildeniz/dnswatch

DNS traffic sniffer and analyzer for monitoring, filtering, and detecting anomalies in DNS queries. Features include PCAP export, DoH support, and a…

osbornepro/btps-secpack

PowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…

knudsenmorten/clientinspectorv2

Azure-based client inventory and drift detection tool that collects Windows configuration data (antivirus, patching, Bitlocker) into LogAnalytics for…

d4rksystem/vboxcloak

A PowerShell script that attempts to help malware analysts hide their Windows VirtualBox Windows VM's from malware that may be trying to evade…

pwndexter/invoke-edrchecker

PowerShell script that enumerates running processes, loaded DLLs, services, registry, and drivers to detect the presence of AV, EDR, and logging…

nextronsystems/ransomware-simulator

Safe ransomware simulation tool for testing antivirus detection. Simulates macro staging, volume shadow copy deletion, document encryption, and note…

sqall01/lsms

Linux Security and Monitoring Scripts

paulnorman01/forensia

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.

jkornev/hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

itm4n/pplcontrol

Windows tool to list, get, set, protect, and unprotect process protection levels (PP/L) for debugging, inspection, and privilege escalation.

alperenugurlu/cmd_bypass_assessment

PowerShell script that automatically tests CMD bypass methods on Windows, evaluates results, calculates a security score, and provides hardening…

bashfuscator/bashfuscator

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

xacone/bestedrofthemarket

Open-source Windows kernel-level EDR lab for understanding and testing detection methods against process injection, credential dumping, and other…