Defensive Tools

bats3c/evtmute

Apply a filter to the events being reported by windows event logging

mohuihui/antispy

AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and…

nccgroup/wubes

Qubes containerization on Windows

xuanxuan0/tietwagent

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

sh4hin/gopurple

Yet another shellcode runner consists of different techniques for evaluating detection capabilities of endpoint security solutions

zeroperil/hookdump

Security product hook detection

p3nt4/powershdll

Run PowerShell with rundll32. Bypass software restrictions.

nccgroup/uninstalledappcanary

A Canary which fires when uninstalled

jthuraisamy/telemetrysourcerer

Enumerate and disable common sources of telemetry used by AV/EDR.

nccgroup/killedprocesscanary

A canary designed to minimize the impact from certain Ransomware actors

d35ha/callobfuscator

Obfuscate specific windows apis with different apis

communityhoneynetwork/chn-server

CommunityHoneyNetwork Server

yjesus/patriot-linux

Host IDS for desktop users

keyboardcrunch/sentinelone-attack-queries

MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity

cedowens/macshellswift

Proof of concept MacOS post exploitation tool written in Swift. Designed as a POC for blue teams to build macOS detections. Author: Cedric Owens

s0lst1c3/dropengine

DropEngine provides a malleable framework for creating shellcode runners, allowing operators to choose from a selection of components and combine…

michenriksen/drawio-threatmodeling

Draw.io libraries for threat modeling diagrams