Defensive Tools

esnet-security/cve-2020-16898

Detects CVE-2020-16898: "Bad Neighbor"

corelight/conn-burst

A Bro package to identify connections that are bursting (lots of data and transferring quickly).

nccgroup/windowsmempagedelta

A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection

rhymeswithmogul/set-zerologonmitigation

Protect your domain controllers against Zerologon (CVE-2020-1472).

trailofbits/sinter

A user-mode application authorization system for MacOS written in Swift

flangvik/sharpapplocker

C# port of the Get-AppLockerPolicy PS cmdlet

pmsosa/duckhunt

:dart: Prevent RubberDucky (or other keystroke injection) attacks

mindedsecurity/behave

Behave! A monitoring browser extension for pages acting as "bad boi"

cyberark/evasor

A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies

spiderlabs/owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)

elevenpaths/amsiext

AMSIext

trycatchhcf/dumpsterfire

"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events.…

pe3zx/crowdstrike-falcon-queries

A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon

cymmetria/weblogic_honeypot

WebLogic Honeypot is a low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. This is…

mindcrypt/powerglot

Powerglot encodes offensive powershell scripts using polyglots . Offensive security tool useful for stego-malware, privilege escalation, lateral…

audibleblink/bothan

Is this IP a C2 server?

bats3c/ghost-in-the-logs

Kernel-level tool to disable Sysmon and Windows Event Logging via driver-based hook injection, enabling stealthy post-exploitation operations on…