Tools for blue team, defensive security, and threat protection.
cloud-architekt/azuread-attack-defenseThis publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can…
withsecurelabs/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
prof.shafiei/abdal-lockboxLocal-first encrypted password vault for Android with Master Password access, Recovery Key support, Autofill integration, and portable encrypted…
mdshoaibuddinchanda/zombieguardML-based detection of Zombie ZIP archive header evasion attacks (CVE-2026-0866)
olafhartong/mde-auditcheckMDE relies on some of the Audit settings to be enabled
elfmaster/mayaHighly advanced Linux anti-exploitation and anti-tamper binary protector for ELF.
scipag/hardeningkittyHardeningKitty - Checks and hardens your Windows configuration
google/safetextGo library for safe YAML and shell generation, using syntax-aware templates to detect and block injection attacks via annotations for trusted data.
codextf2/cobaltstrike-sleepmask-yaraJust a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-…
thinkst/canarytokens-dockerDocker configuration to quickly setup your own Canarytokens.
jonny-jhnson/msrpc-to-attackA repository that maps commonly used attacks using MSRPC protocols to ATT&CK
gendigitalinc/iocA continuously updated collection of threat intelligence indicators of compromise (IOCs), including YARA rules, for detecting and tracking malware…
olafhartong/sysmon-modularA repository of sysmon configuration modules
singe/yellowA simple binary wrapper for DNS canarytokens.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
zephrfish/autohoneypocAutoPoC Generator HoneyPoC
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
