Defensive Tools

0x0v1/audix

Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring

gabriellandau/edrsandblast-godfault

EDRSandblast-GodFault

accenture/spartacus

Spartacus DLL/COM Hijacking Toolkit

optiv/mangle

Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs

swimlane/atomic-operator

A Python package is used to execute Atomic Red Team tests (Atomics) across multiple operating system environments.

idov31/functionstomping

Shellcode injection technique. Given as C++ header, standalone Rust program or library.

chryzsh/darthsidious

Building an Active Directory domain and hacking it

hlldz/reflexxion

RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first…

salesforce/metabadger

Prevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 (IMDSv2).

ranguli/ioccheck

A tool for simplifying the process of researching IOCs.

optiv/dent

A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.

trailofbits/sinter

A user-mode application authorization system for MacOS written in Swift

google/santa

A binary authorization and monitoring system for macOS

efforg/https-everywhere

A browser extension that encrypts your communications with many websites that offer HTTPS but still allow unencrypted connections.

cloudflare/mitmengine

A MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:

m-mizutani/alertresponder

Automatic security alert response framework by AWS Serverless Application Model