Sentinel-Queries
reprise99/sentinel-queriesCurated collection of Microsoft Sentinel KQL queries and tutorials for hunting threats, analyzing Azure AD sign-in logs, detecting anomalies, and…
defensive-toolsthreat-intelligenceeducation+3
1.6k
Tools for blue team, defensive security, and threat protection.
reprise99/sentinel-queriesCurated collection of Microsoft Sentinel KQL queries and tutorials for hunting threats, analyzing Azure AD sign-in logs, detecting anomalies, and…
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
wavestone-cdt/edrsandblastWeaponizes vulnerable signed drivers to bypass EDR kernel callbacks, object callbacks, ETW TI provider, and userland hooks for LSASS memory dumping…
s3cur3th1ssh1t/amsi-bypass-powershellThis repo contains some Amsi Bypass methods i found on different Blog Posts.
browserbox/browserbox💚🇺🇸🗽Secure remote browsing anywhere, any way you like it.
bashfuscator/bashfuscatorA fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.
jthuraisamy/syswhispers2AV/EDR evasion via direct system calls.
aikidosec/safe-chainProtect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.
ossf/allstarGitHub App to set and enforce security policies
jakehildreth/locksmithA small tool built to find and fix common misconfigurations in Active Directory Certificate Services.
nextronsystems/aptsimulatorA toolset to make a system look as if it was the victim of an APT attack
yjeanrenaud/yj_nearbyglassesattempting to detect smart glasses nearby and warn you
hardentools/hardentoolsHardentools simply reduces the attack surface on Microsoft Windows computers by disabling low-hanging fruit risky features.
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
rasta-mouse/threatcheckIdentifies the bytes that Microsoft Defender / AMSI Consumer flags on.
googleprojectzero/sandbox-attacksurface-analysis-toolsSet of tools to analyze Windows sandboxes for exposed attack surface.